Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
General
-
Target
file.exe
-
Size
4.8MB
-
MD5
b96a4c0fa46b7bf0c8291ff225ae2b75
-
SHA1
8b66b69c25dd93ba86b50385132a8e9743b5d390
-
SHA256
13f0dc7a12f1bc8d4a79097e51f673358380cc825fbf892f696fc8355c52b838
-
SHA512
364c944689578951d955be0fb74e4853bf41ed2c789bca868fc4d7d3b2d8f8ae927f5c68ecaf39720472a81960c4f7bdf6b499e8f36d18aa91c986846bdaae2f
-
SSDEEP
98304:xIgGQX0j7lrKfiAH3NBueHGUd1ekqFeACo7vwBTYNa56EmTS4P:xgleRXNBu4HviwYw5te9
Malware Config
Signatures
Files
-
file.exe.exe windows x86
172750858dcc0719eed08c952858023c
Code Sign
77:08:39:81:cb:a0:95:b3:46:f6:b1:8b:6e:e1:d2:94Certificate
IssuerCN=‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓Not Before06/09/2022, 14:10Not After07/09/2032, 14:10SubjectCN=‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before11/05/2022, 00:00Not After10/08/2033, 23:59SubjectCN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02/05/2019, 00:00Not After18/01/2038, 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
07:ef:d4:6b:1c:16:b7:b4:7a:ae:2f:32:82:ff:14:42:8b:42:e0:97:9f:e2:c1:4c:4e:51:3e:bc:f5:9b:79:fcSigner
Actual PE Digest07:ef:d4:6b:1c:16:b7:b4:7a:ae:2f:32:82:ff:14:42:8b:42:e0:97:9f:e2:c1:4c:4e:51:3e:bc:f5:9b:79:fcDigest Algorithmsha256PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓26/08/2022, 16:48 Valid: false
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
RaiseException
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
ole32
OleInitialize
oleaut32
SafeArrayCreate
wtsapi32
WTSSendMessageW
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Sections
.text Size: 102KB - Virtual size: 101KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
‡↓Æ Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
‡↓Æ Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 393KB - Virtual size: 393KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ