Static task
static1
Behavioral task
behavioral1
Sample
lrPBx4qjVQLL.exe
Resource
win7-20220901-en
General
-
Target
file_1.zip
-
Size
1.2MB
-
MD5
37a9fc03362d4e2a91028ea12d5440ea
-
SHA1
539477312c35364d485f76b641d89b66c702def5
-
SHA256
012a4528bb6b9dde780d627a0f22b440ff26fac4a80ebc91266a7cc95f324d4b
-
SHA512
49ac51db69e4201b8c8af206dd35b62b448a7c713cbf564266e98d29953b5a8673202331c663da6b7bc241a1435a23f06bf477e1546f8b9f79070aea66c51b52
-
SSDEEP
24576:4cygxEOtU5GOYK232r5hHxBry22LLIp8wm1mK3Pi07eIPac9sB:4cyWEbQLmr5hHxBrOvhlmWi0iIymc
Malware Config
Signatures
Files
-
file_1.zip.zip
-
lrPBx4qjVQLL.exe.exe windows x86
af58d77e2de72a34dfec8ea762118eda
Code Sign
06:2b:28:27:50:0c:5d:f3:5a:83:f6:61:b3:af:5d:d3Certificate
IssuerCN=Sectigo RSA Domain Validation Secure Server CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before02-05-2022 00:00Not After02-05-2023 23:59SubjectCN=*.eos.com7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate
IssuerCN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=USNot Before12-01-2016 00:00Not After11-01-2031 23:59SubjectCN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate
IssuerCN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=USNot Before23-12-2017 00:00Not After22-03-2029 23:59SubjectCN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
ad:b6:af:07:e5:f4:0e:59:46:7c:a6:ad:e9:17:29:92:7f:80:4e:e5:79:cd:bb:25:8d:bb:50:3f:ca:66:63:3eSigner
Actual PE Digestad:b6:af:07:e5:f4:0e:59:46:7c:a6:ad:e9:17:29:92:7f:80:4e:e5:79:cd:bb:25:8d:bb:50:3f:ca:66:63:3eDigest Algorithmsha256PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=*.eos.com26-09-2022 14:32 Valid: false
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GlobalCompact
GetProfileIntW
FreeLibrary
InterlockedIncrement
InterlockedCompareExchange
ReadConsoleW
SetHandleCount
FormatMessageW
SetConsoleCP
SetConsoleTitleA
VerifyVersionInfoW
GetHandleInformation
GetLastError
GetProcAddress
GetConsoleAliasesLengthW
LoadLibraryA
BuildCommDCBAndTimeoutsW
VirtualLock
GetCurrentConsoleFont
HeapWalk
FoldStringA
GetDefaultCommConfigA
AcquireSRWLockShared
PurgeComm
GetConsoleScreenBufferInfoEx
ReleaseMutex
CreateFileA
PulseEvent
FindFirstChangeNotificationW
CreateConsoleScreenBuffer
GetFullPathNameW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapFree
HeapAlloc
HeapReAlloc
GetCommandLineA
GetStartupInfoA
TerminateProcess
GetCurrentProcess
IsDebuggerPresent
GetModuleHandleW
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
EnterCriticalSection
LeaveCriticalSection
GetFileType
DeleteCriticalSection
HeapCreate
VirtualFree
VirtualAlloc
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
InterlockedDecrement
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
HeapSize
GetLocaleInfoA
GetConsoleCP
GetConsoleMode
FlushFileBuffers
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
ReadFile
SetFilePointer
CloseHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
user32
LoadBitmapW
LoadMenuA
gdi32
GetFontLanguageInfo
advapi32
OpenBackupEventLogA
Sections
.text Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 165KB - Virtual size: 165KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ