Static task
static1
Behavioral task
behavioral1
Sample
Payment Confirmation Ref-876627.exe
Resource
win7-20220414-en
General
-
Target
Payment Confirmation Ref-876627.exe
-
Size
1.1MB
-
MD5
2d75aafb29ad71871745dce716de4517
-
SHA1
23f737a59884324f91c86af756f97f272e07cedc
-
SHA256
58274c41a987c806022f227b6df900bb1bd3fab9a7a87a3d34a5bd4f1b58980d
-
SHA512
491500861bfe415470e2dba2aaa448bf3ab9056e49a1e753835a59a6925de56c5947b794d564fbc83d948361fd3f0a60ae7a4c9acfd2896397636bdc51b7f7b1
-
SSDEEP
24576:WpEKdWPrAfKYpyBGR/vcaDOK+AKNvbgN+T4NMkPpgjNztMjmK5vvtt:WphdkrAfKYMBGR/vLDOK+AKxvTIMkmj8
Malware Config
Signatures
Files
-
Payment Confirmation Ref-876627.exe.exe windows x86
ea816a6366467a07e2a9e44a00aa51f8
Code Sign
08:5b:51:39:18:e9:7d:06:31:94:8c:1d:69:a8:36:7aCertificate
IssuerCN=Amazon,OU=Server CA 1B,O=Amazon,C=USNot Before12-08-2021 00:00Not After10-09-2022 23:59SubjectCN=statista.com7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate
IssuerCN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=USNot Before12-01-2016 00:00Not After11-01-2031 23:59SubjectCN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate
IssuerCN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=USNot Before23-12-2017 00:00Not After22-03-2029 23:59SubjectCN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
23:dd:fa:5c:2f:fe:d3:a3:1f:9e:06:ee:9f:7c:aa:3d:e4:cd:ab:d9:0e:6f:26:40:ea:fb:1a:b6:a3:a1:d9:66Signer
Actual PE Digest23:dd:fa:5c:2f:fe:d3:a3:1f:9e:06:ee:9f:7c:aa:3d:e4:cd:ab:d9:0e:6f:26:40:ea:fb:1a:b6:a3:a1:d9:66Digest Algorithmsha256PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=statista.com03-05-2022 20:34 Valid: false
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcessHeap
GlobalAlloc
LoadLibraryW
GetCalendarInfoA
GetBinaryTypeA
GetProcAddress
GetCurrentThreadId
CloseHandle
WriteConsoleW
FlushFileBuffers
ClearCommError
SetFilePointer
GetConsoleMode
GetConsoleCP
HeapSize
GetStringTypeW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
CommConfigDialogA
FindVolumeClose
SetStdHandle
CreateFileA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
InterlockedIncrement
InterlockedDecrement
EncodePointer
DecodePointer
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetLastError
HeapFree
HeapReAlloc
MultiByteToWideChar
GetModuleHandleW
ExitProcess
GetCommandLineW
HeapSetInformation
GetStartupInfoW
RaiseException
RtlUnwind
HeapAlloc
CompareStringW
GetCPInfo
WideCharToMultiByte
LCMapStringW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
HeapCreate
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
ReadFile
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetLocaleInfoW
WriteFile
GetModuleFileNameW
CreateFileW
user32
DestroyWindow
GetMessageW
PostQuitMessage
LoadCursorW
TranslateMessage
RegisterClassExW
LoadIconW
ShowWindow
CreateWindowExW
MessageBoxW
UpdateWindow
DefWindowProcW
DispatchMessageW
GetForegroundWindow
gdi32
GetTextFaceA
GetTextColor
SetTextColor
oleaut32
SafeArrayCreate
SafeArrayDestroy
Sections
.text Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ