Static task
static1
Behavioral task
behavioral1
Sample
5986aff76e7813045b1b130efbb10d30.exe
Resource
win7-20220812-en
General
-
Target
5986aff76e7813045b1b130efbb10d30.exe
-
Size
1.9MB
-
MD5
5986aff76e7813045b1b130efbb10d30
-
SHA1
62b1f733fe7ed0c0230c20dae3c4a65ecb28e180
-
SHA256
7dd44d3b3df4f14474d20ffa23e2fb20dcf22ed3a1458b345a1bd85563ac4a62
-
SHA512
bfa2cad2bbbb61af7dbd22818db048ddaf68e2e22d1c55d80450a7a0c4c31c09bf596f04ebc2a7f55ac70c294ae01d3e8987af4d0bbb60c63662d21c008b3115
-
SSDEEP
24576:ytmVBxgdQncWHOY7XgOxv5zM44Q84u7cpS/G6bLZLI6FMPNK/bAkA/lDA:Jjou3H/Dxxr40uIB6bO6mYPAS
Malware Config
Signatures
Files
-
5986aff76e7813045b1b130efbb10d30.exe.exe windows x86
af58d77e2de72a34dfec8ea762118eda
Code Sign
04:70:ca:70:5c:f6:9c:c3:7f:88:20:17:ef:7d:ac:4e:7e:81Certificate
IssuerCN=R3,O=Let's Encrypt,C=USNot Before28-08-2022 04:23Not After26-11-2022 04:23SubjectCN=wire.com7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate
IssuerCN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=USNot Before12-01-2016 00:00Not After11-01-2031 23:59SubjectCN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate
IssuerCN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=USNot Before23-12-2017 00:00Not After22-03-2029 23:59SubjectCN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
d1:6b:46:7b:3e:8c:12:9e:ca:05:a6:1a:15:66:9f:da:3f:09:a0:ac:5b:2a:0e:00:78:17:1e:be:ad:4d:e0:3bSigner
Actual PE Digestd1:6b:46:7b:3e:8c:12:9e:ca:05:a6:1a:15:66:9f:da:3f:09:a0:ac:5b:2a:0e:00:78:17:1e:be:ad:4d:e0:3bDigest Algorithmsha256PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=wire.com26-09-2022 14:08 Valid: false
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GlobalCompact
GetProfileIntW
FreeLibrary
InterlockedIncrement
InterlockedCompareExchange
ReadConsoleW
SetHandleCount
FormatMessageW
SetConsoleCP
SetConsoleTitleA
VerifyVersionInfoW
GetHandleInformation
GetLastError
GetProcAddress
GetConsoleAliasesLengthW
LoadLibraryA
BuildCommDCBAndTimeoutsW
VirtualLock
GetCurrentConsoleFont
HeapWalk
FoldStringA
GetDefaultCommConfigA
AcquireSRWLockShared
PurgeComm
GetConsoleScreenBufferInfoEx
ReleaseMutex
CreateFileA
PulseEvent
FindFirstChangeNotificationW
CreateConsoleScreenBuffer
GetFullPathNameW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapFree
HeapAlloc
HeapReAlloc
GetCommandLineA
GetStartupInfoA
TerminateProcess
GetCurrentProcess
IsDebuggerPresent
GetModuleHandleW
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
EnterCriticalSection
LeaveCriticalSection
GetFileType
DeleteCriticalSection
HeapCreate
VirtualFree
VirtualAlloc
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
InterlockedDecrement
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
HeapSize
GetLocaleInfoA
GetConsoleCP
GetConsoleMode
FlushFileBuffers
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
ReadFile
SetFilePointer
CloseHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
user32
LoadBitmapW
LoadMenuA
gdi32
GetFontLanguageInfo
advapi32
OpenBackupEventLogA
Sections
.text Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 367KB - Virtual size: 367KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ