Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
General
-
Target
file.exe
-
Size
5.0MB
-
MD5
3205eb3344a4d974d0e1b9729cc33268
-
SHA1
2b588df9769ae39fdd2c6b288b6978b64a179c5c
-
SHA256
e67f65a08f1d5690c66652b20ae9f34352436231a0a365c4a6ec45143a4df46d
-
SHA512
a2f6c28fd70a36f55dba3aa8776eeb0ec1824bbc440053491022fd579fa87059ff809b933a82176e300ffaccb3c1208192a79eac4686a253961505b0662dc652
-
SSDEEP
98304:5BTSWJx7Mvet2Fhh780QbYWuN2l5ug+2CxGzoyO+5jwH3Ir64QILp0:5rJJpwR5QbQNy5ug+lGjX5sH3KII90
Malware Config
Signatures
Files
-
file.exe.exe windows x86
172750858dcc0719eed08c952858023c
Code Sign
18:8e:a0:d2:66:0b:4a:86:41:6a:26:ea:e2:2a:c7:9cCertificate
IssuerCN=↯ ↰ ↱↯ ↰ ↱↯ ↰ ↱↯ ↰ ↱↯ ↰ ↱↯ ↰ ↱↯ ↰ ↱↯ ↰ ↱↯ ↰ ↱↯ ↰ ↱↯ ↰ ↱↯ ↰ ↱↯ ↰ ↱Not Before08/09/2022, 12:20Not After09/09/2032, 12:20SubjectCN=↯ ↰ ↱↯ ↰ ↱↯ ↰ ↱↯ ↰ ↱↯ ↰ ↱↯ ↰ ↱↯ ↰ ↱↯ ↰ ↱↯ ↰ ↱↯ ↰ ↱↯ ↰ ↱↯ ↰ ↱↯ ↰ ↱90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before11/05/2022, 00:00Not After10/08/2033, 23:59SubjectCN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02/05/2019, 00:00Not After18/01/2038, 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
a3:8a:48:63:2d:d4:aa:30:f4:95:f1:43:98:5a:25:c6:bf:2c:69:d3:d8:96:e2:82:68:91:96:fc:15:85:9d:18Signer
Actual PE Digesta3:8a:48:63:2d:d4:aa:30:f4:95:f1:43:98:5a:25:c6:bf:2c:69:d3:d8:96:e2:82:68:91:96:fc:15:85:9d:18Digest Algorithmsha256PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=↯ ↰ ↱↯ ↰ ↱↯ ↰ ↱↯ ↰ ↱↯ ↰ ↱↯ ↰ ↱↯ ↰ ↱↯ ↰ ↱↯ ↰ ↱↯ ↰ ↱↯ ↰ ↱↯ ↰ ↱↯ ↰ ↱09/09/2022, 12:44 Valid: false
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
RaiseException
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
ole32
OleInitialize
oleaut32
SafeArrayCreate
wtsapi32
WTSSendMessageW
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Sections
.text Size: 102KB - Virtual size: 101KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ƃ†� Size: 2.9MB - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
ƃ†� Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 33KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ