Static task
static1
Behavioral task
behavioral1
Sample
baafd8f9b5889d49921f5e4c6fc3ca051f42d1c50a6b1db65986bcfb6e10f344.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
baafd8f9b5889d49921f5e4c6fc3ca051f42d1c50a6b1db65986bcfb6e10f344.exe
Resource
win10v2004-20220414-en
General
-
Target
baafd8f9b5889d49921f5e4c6fc3ca051f42d1c50a6b1db65986bcfb6e10f344
-
Size
7.9MB
-
MD5
489cc8b0ccf627680dac49fea149e42c
-
SHA1
e9d9e02d771ce714ba5198b2809f22a21d2fb076
-
SHA256
baafd8f9b5889d49921f5e4c6fc3ca051f42d1c50a6b1db65986bcfb6e10f344
-
SHA512
ef6ed6a6dcaf25579536d8b473006c01527220d7d59db3d82b7c6aeb71370973815cd921c9220bb6983da09ebcd29d70f20441a530335383a3970cecf4932472
-
SSDEEP
196608:HIZQtULsem0WX3sftJf5205uRTcgb5HZq2RIb5:oZH3mB3sffhIRogb5HoT5
Malware Config
Signatures
Files
-
baafd8f9b5889d49921f5e4c6fc3ca051f42d1c50a6b1db65986bcfb6e10f344.exe windows x86
88f4f14368ffceba9a05d05d84700960
Code Sign
01Certificate
IssuerCN=ISoft,OU=IT,O=ISoft,L=Harare,ST=Harare,C=ZW,1.2.840.113549.1.9.1=#0c0f69736f66744069736f66742e636f6dNot Before15-05-2018 08:17Not After12-05-2028 08:17SubjectCN=GSoft,OU=IT,O=GSoft,L=Harare,ST=Harare,C=ZW,1.2.840.113549.1.9.1=#0c0f67736f66744067736f66742e636f6d2e:97:1a:1b:58:0c:10:aa:15:ef:f0:76:b2:c5:a2:e8:b5:a8:2b:81Signer
Actual PE Digest2e:97:1a:1b:58:0c:10:aa:15:ef:f0:76:b2:c5:a2:e8:b5:a8:2b:81Digest Algorithmsha1PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=GSoft,OU=IT,O=GSoft,L=Harare,ST=Harare,C=ZW,1.2.840.113549.1.9.1=#0c0f67736f66744067736f66742e636f6d18-05-2022 18:08 Valid: false
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WriteFile
CloseHandle
GetConsoleWindow
Sleep
GetProcAddress
GetTempPathA
GetFileAttributesA
GetLastError
GetSystemDirectoryA
VirtualAlloc
VirtualFree
WaitForSingleObject
RaiseException
WriteConsoleW
CreateFileA
LockResource
LoadResource
SizeofResource
GetModuleHandleA
CreateDirectoryA
FindResourceA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetStdHandle
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
GetACP
HeapFree
HeapAlloc
GetFileType
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
CompareStringW
LCMapStringW
SetStdHandle
GetStringTypeW
GetProcessHeap
HeapSize
HeapReAlloc
GetConsoleCP
GetConsoleMode
SetFilePointerEx
FlushFileBuffers
DecodePointer
CreateFileW
user32
ShowWindow
advapi32
OpenServiceA
ChangeServiceConfig2W
CloseServiceHandle
CreateServiceA
OpenSCManagerA
StartServiceA
Sections
.text Size: 64KB - Virtual size: 63KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 172B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 7.8MB - Virtual size: 7.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ