Static task
static1
Behavioral task
behavioral1
Sample
ebb86bff468a3b482b724efc18a226b5.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
ebb86bff468a3b482b724efc18a226b5.exe
Resource
win10-en-20211208
General
-
Target
ebb86bff468a3b482b724efc18a226b5
-
Size
599KB
-
MD5
ebb86bff468a3b482b724efc18a226b5
-
SHA1
8e9d5f32146bb17b56c9cdd61023ace27982c44c
-
SHA256
677b8d2a671f9f2de4e110adaf6eb12f74c9feb15dcd9e6e6c126f668676cf57
-
SHA512
a49113e697b58d300b9404b5b5a046240b185c38242c78ac7f26891976915e92439ff8ec636af4c2bad5b0015574c21ea518db10918bc2cf843afdde713854c7
-
SSDEEP
12288:R0QIHFmG+WJ49GOgq1grTl2R5ePl0hQyzY77eyh:R0QIZ4GgGla5ePFyM7yyh
Malware Config
Signatures
Files
-
ebb86bff468a3b482b724efc18a226b5.exe windows x86
b0749eca4aebd004c2effe007cf810c2
Code Sign
11:90:c0:dd:da:12:30:9f:47:12:3c:27:1e:45:21:8eCertificate
IssuerCN=Polaroid Candy KR (SWL 7008-04)Not Before26-01-2022 00:33Not After27-01-2032 00:33SubjectCN=Polaroid Candy KR (SWL 7008-04)8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before23-10-2020 00:00Not After22-01-2032 23:59SubjectCN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02-05-2019 00:00Not After18-01-2038 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
28:3b:0b:60:59:6c:08:21:33:1f:02:ae:2e:c4:a4:5f:3e:1f:07:3c:aa:ae:30:b5:94:9c:45:56:2e:94:dc:77Signer
Actual PE Digest28:3b:0b:60:59:6c:08:21:33:1f:02:ae:2e:c4:a4:5f:3e:1f:07:3c:aa:ae:30:b5:94:9c:45:56:2e:94:dc:77Digest Algorithmsha256PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=Polaroid Candy KR (SWL 7008-04)27-01-2022 16:14 Valid: false
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleA
user32
OffsetRect
advapi32
RegisterEventSourceA
mscoree
_CorExeMain
shell32
SHGetIconOverlayIndexA
comctl32
ImageList_Create
Sections
.CRT Size: - Virtual size: 228KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.didata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 128KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
DATA Size: 94KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE