Static task
static1
Behavioral task
behavioral1
Sample
3a3a6db3d266830cd471cbb84d1707e915bf3ffbe54b84abff5ee703d91e6485.exe
Resource
win7-20220414-en
General
-
Target
3a3a6db3d266830cd471cbb84d1707e915bf3ffbe54b84abff5ee703d91e6485
-
Size
713KB
-
MD5
4d94576cdf1c060b6147d88bc438ec64
-
SHA1
b09269028fa0b095afbedbc87a44768b5a29a6d7
-
SHA256
3a3a6db3d266830cd471cbb84d1707e915bf3ffbe54b84abff5ee703d91e6485
-
SHA512
4157976180155c7f3341c226f2fbc6730243263180aa059aa8cd0604377f068e44bd7f1005ea5e99c4ea07e76612db83adaca6f5f012bef396e87386c41dc5a5
-
SSDEEP
12288:E6mWXMKp3mw5fD47zw7tOBzd/RIDlqaw66nq+RPMdARbIIIIIIIIIIIIIIIIIIIw:EmXM2L5f6wg1d/RIDMRq+RoARbIIIIIs
Malware Config
Signatures
Files
-
3a3a6db3d266830cd471cbb84d1707e915bf3ffbe54b84abff5ee703d91e6485.exe windows x86
dfda9a5f9b59f8c4a547412b775fabd5
Code Sign
01Certificate
IssuerCN=http://www.light-alloy.ru,O=Akeo Consulting (http://akeo.ie),C=JPNot Before11-09-2018 14:46Not After10-09-2021 14:46SubjectCN=http://www.light-alloy.ru,O=Akeo Consulting (http://akeo.ie),C=JP11:21:b4:55:35:1e:bb:1a:b2:4f:97:ef:07:fe:2a:b3:0b:8aCertificate
IssuerCN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BENot Before24-05-2016 00:00Not After24-06-2027 00:00SubjectCN=GlobalSign TSA for Standard - G2,O=GMO GlobalSign Pte Ltd,C=SGExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
04:00:00:00:00:01:2f:4e:e1:52:d7Certificate
IssuerCN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BENot Before13-04-2011 10:00Not After28-01-2028 12:00SubjectCN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BEKey Usages
KeyUsageCertSign
KeyUsageCRLSign
82:6c:dd:7b:5b:07:21:23:ec:65:79:4c:c2:c1:24:ea:ee:68:6b:1d:fd:c5:94:49:e4:56:58:6a:06:39:59:20Signer
Actual PE Digest82:6c:dd:7b:5b:07:21:23:ec:65:79:4c:c2:c1:24:ea:ee:68:6b:1d:fd:c5:94:49:e4:56:58:6a:06:39:59:20Digest Algorithmsha256PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=http://www.light-alloy.ru,O=Akeo Consulting (http://akeo.ie),C=JP11-09-2018 22:46 Valid: false
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
_CIcos
_adj_fptan
__vbaFreeVar
__vbaFreeVarList
_adj_fdiv_m64
ord698
_adj_fprem1
__vbaInStrVarB
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaOnError
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
_CIsin
__vbaChkstk
EVENT_SINK_AddRef
__vbaStrCmp
__vbaAryConstruct2
__vbaPrintObj
DllFunctionCall
_adj_fpatan
__vbaRedim
EVENT_SINK_Release
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
__vbaFPException
__vbaI2Var
ord537
ord645
_CIlog
__vbaErrorOverflow
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaI4Str
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord100
__vbaI4Var
__vbaStrToAnsi
__vbaFpI4
ord616
ord617
_CIatan
__vbaStrMove
_allmul
_CItan
_CIexp
__vbaFreeStr
__vbaFreeObj
Sections
.text Size: 672KB - Virtual size: 669KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ