Static task
static1
Behavioral task
behavioral1
Sample
22930bdbe1a579ae17c1f1563556acc7.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
22930bdbe1a579ae17c1f1563556acc7.exe
Resource
win10-en-20211208
General
-
Target
22930bdbe1a579ae17c1f1563556acc7
-
Size
623KB
-
MD5
22930bdbe1a579ae17c1f1563556acc7
-
SHA1
ea9b9bd8e6b858ba7c36263b5a9eee4ce18b53e7
-
SHA256
963c04618351dd9deec457067f8c8b0857e85e106f5b8bd9c9d33b42c8e9e154
-
SHA512
aab60c1dbeced8487faf5d0b5864b185f956225a23cfab1336bb4344ccc09d6678a03f91d69167f26e0f807154e86a6d1dd8ed8ede4512a02172a0a0d601f949
-
SSDEEP
12288:xMklgNT+G4mnhhfc5WZVG4+SNkeNlG2W76Enpd8JQz2sh3n0KZ:oT+GzhhfcskezG2cnWsh3n0KZ
Malware Config
Signatures
Files
-
22930bdbe1a579ae17c1f1563556acc7.exe windows x86
df40551e0167de25598e175e3044a574
Code Sign
11:90:c0:dd:da:12:30:9f:47:12:3c:27:1e:45:21:8eCertificate
IssuerCN=Polaroid Candy KR (SWL 7008-04)Not Before26-01-2022 00:33Not After27-01-2032 00:33SubjectCN=Polaroid Candy KR (SWL 7008-04)8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before23-10-2020 00:00Not After22-01-2032 23:59SubjectCN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02-05-2019 00:00Not After18-01-2038 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
26:91:75:af:1e:d9:f0:85:e4:6a:b5:b8:79:cc:a2:6e:0a:95:d5:2b:c6:90:3b:f8:d8:6d:3f:32:a7:fb:78:a4Signer
Actual PE Digest26:91:75:af:1e:d9:f0:85:e4:6a:b5:b8:79:cc:a2:6e:0a:95:d5:2b:c6:90:3b:f8:d8:6d:3f:32:a7:fb:78:a4Digest Algorithmsha256PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=Polaroid Candy KR (SWL 7008-04)28-01-2022 14:04 Valid: false
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleA
user32
CreateCursor
advapi32
RegisterEventSourceA
comctl32
ImageList_Draw
mscoree
_CorExeMain
shell32
SHGetIconOverlayIndexA
Sections
.ctors Size: - Virtual size: 228KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 152KB - Virtual size: 152KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
DATA Size: 94KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE