Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
General
-
Target
file.exe
-
Size
4.6MB
-
MD5
27fc32e3ba1f4f73c32a70349e957077
-
SHA1
32f0f0e2e58c6d259cd6fa462420a18f73be8ca9
-
SHA256
a9f13964a225099d83f98a44023f8501c138c31a585bf9340dab2424cfc9a926
-
SHA512
7474f6886871777312fe22b0fda9380f539d9bbbf344e1301f14cdfcec7c2a2c5a7fdabf7b4a791b00f3f72cb8b7da5779b1781d8b842f749788c4697f227210
-
SSDEEP
98304:4UCaYPhZ1/RIAWKPTAs3R1Bi/ngZ1wykqaf3jYhH:4nhH/hF39+ngZ1wymEH
Malware Config
Signatures
Files
-
file.exe.exe windows x86
172750858dcc0719eed08c952858023c
Code Sign
77:08:39:81:cb:a0:95:b3:46:f6:b1:8b:6e:e1:d2:94Certificate
IssuerCN=‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓Not Before06/09/2022, 14:10Not After07/09/2032, 14:10SubjectCN=‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before11/05/2022, 00:00Not After10/08/2033, 23:59SubjectCN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02/05/2019, 00:00Not After18/01/2038, 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
34:3d:0c:b0:42:c0:e9:2e:95:8b:ce:ba:39:56:ee:7a:1e:c8:8e:e1:09:aa:7f:a3:d4:21:e8:11:c3:d0:4d:84Signer
Actual PE Digest34:3d:0c:b0:42:c0:e9:2e:95:8b:ce:ba:39:56:ee:7a:1e:c8:8e:e1:09:aa:7f:a3:d4:21:e8:11:c3:d0:4d:84Digest Algorithmsha256PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓‡↓↓26/08/2022, 16:50 Valid: false
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
RaiseException
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
ole32
OleInitialize
oleaut32
SafeArrayCreate
wtsapi32
WTSSendMessageW
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Sections
.text Size: 102KB - Virtual size: 101KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
‡↓Æ Size: 2.6MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
‡↓Æ Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 60KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ