Static task
static1
Behavioral task
behavioral1
Sample
c70ce79a896aba71f8de49078119d5abf8ac17e3895de6c150563d425d8135d4.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
c70ce79a896aba71f8de49078119d5abf8ac17e3895de6c150563d425d8135d4.exe
Resource
win10v2004-20220812-en
General
-
Target
c70ce79a896aba71f8de49078119d5abf8ac17e3895de6c150563d425d8135d4
-
Size
276KB
-
MD5
422d4c0e8b1344b905affff4b380e590
-
SHA1
570a3a3ee663f8551449a0d29753bc4ac1061050
-
SHA256
c70ce79a896aba71f8de49078119d5abf8ac17e3895de6c150563d425d8135d4
-
SHA512
61c95f9be9db768fac83811bd5ab20a699582aaea1ce6d73cbf3e422675012a56217f6ee85244371a31b7435fb907a6c5ce71eb4e2c136ab20aa89741b634744
-
SSDEEP
6144:xsBLvxt3QSNOatCQ/Y4FlsY3SpFZGu/BKj5:6vxtguzw4jYnBw
Malware Config
Signatures
Files
-
c70ce79a896aba71f8de49078119d5abf8ac17e3895de6c150563d425d8135d4.exe windows x86
a8af141abdf86699070f28a0b1dbc791
Code Sign
01Certificate
IssuerCN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6dNot Before01/08/1996, 00:00Not After31/12/2020, 23:59SubjectCN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d0aCertificate
IssuerCN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6dNot Before06/08/2003, 00:00Not After05/08/2013, 23:59SubjectCN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZAExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before15/06/2007, 00:00Not After14/06/2012, 23:59SubjectCN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
7e:1b:96:85:8d:71:ee:78:11:69:12:bc:31:80:70:2cCertificate
IssuerCN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZANot Before30/09/2009, 00:00Not After20/10/2011, 23:59SubjectCN=CJSC Computing Forces,OU=IT,O=CJSC Computing Forces,L=Moscow,ST=Moscow,C=RUExtended Key Usages
ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04/12/2003, 00:00Not After03/12/2013, 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Signer
Actual PE DigestDigest AlgorithmPE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ole32
CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
user32
UpdateWindow
AttachThreadInput
RegisterClassExW
GetDC
GetDlgItem
SetScrollInfo
DrawFocusRect
GetMonitorInfoW
GetClassInfoExW
SendMessageW
SetForegroundWindow
BeginPaint
GetParent
WindowFromPoint
DispatchMessageW
DeferWindowPos
GetAncestor
ScreenToClient
KillTimer
LoadStringW
GetWindowRect
ShowWindow
GetCursorPos
AdjustWindowRectEx
IsWindow
GetSystemMenu
ScrollWindowEx
LoadCursorW
EqualRect
SetTimer
TranslateMessage
DrawTextW
ReleaseDC
FindWindowW
wsprintfW
SetDlgItemTextW
SetWindowLongW
GetDlgCtrlID
GetClientRect
SetWindowPos
DestroyWindow
MonitorFromRect
DrawIconEx
EndPaint
CharNextW
LoadIconW
UnregisterClassA
GetWindowThreadProcessId
ClientToScreen
GetMenu
GetIconInfo
PtInRect
SystemParametersInfoW
PostMessageW
GetForegroundWindow
GetDesktopWindow
CreateDialogIndirectParamW
RedrawWindow
GetKeyState
GetWindowLongW
DialogBoxParamW
LoadImageW
IntersectRect
DestroyIcon
BeginDeferWindowPos
FillRect
MonitorFromWindow
IsIconic
EndDeferWindowPos
SetCursor
CallWindowProcW
CopyRect
GetWindowTextW
SendMessageTimeoutW
EndDialog
PeekMessageW
GetSysColor
EnableWindow
GetWindow
CreateWindowExW
SetWindowTextW
DefWindowProcW
GetSystemMetrics
WindowFromDC
InvalidateRect
EnableMenuItem
SetFocus
GetScrollInfo
SetRect
GetMessageW
FindWindowExW
GetTopWindow
GetNextDlgTabItem
MapWindowPoints
oleaut32
VarUI4FromStr
gdi32
CreateSolidBrush
GetClipBox
DeleteDC
DPtoLP
CreateCompatibleBitmap
TextOutW
SetTextJustification
SetBkColor
CreateBitmap
Rectangle
StretchBlt
EnumFontFamiliesExW
SetBkMode
SetTextAlign
SetTextColor
GetTextMetricsW
CreateCompatibleDC
CreateFontIndirectW
GetMapMode
SetWindowOrgEx
CreateDCW
GetDeviceCaps
SetMapMode
SelectObject
GetObjectW
DeleteObject
GetTextExtentPoint32W
GetStockObject
BitBlt
comctl32
InitCommonControlsEx
kernel32
CreateMutexW
lstrcmpiW
SetLastError
GetFileSize
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
CloseHandle
ReleaseMutex
HeapDestroy
ReadFile
SizeofResource
EnterCriticalSection
VirtualAlloc
OutputDebugStringW
GetACP
LockResource
GetCurrentThreadId
FreeLibrary
LoadLibraryExW
DeleteCriticalSection
HeapSize
MulDiv
HeapAlloc
LoadResource
GetProcessHeap
FreeResource
FindResourceExW
SetUnhandledExceptionFilter
lstrlenW
RaiseException
lstrlenA
UnhandledExceptionFilter
FindResourceW
VirtualFree
WideCharToMultiByte
HeapReAlloc
CreateFileW
LeaveCriticalSection
FlushInstructionCache
IsDebuggerPresent
LocalAlloc
HeapFree
GetModuleHandleW
GetLocalTime
VirtualAllocEx
atl
AtlModuleInit
AtlAxGetControl
AtlPixelToHiMetric
DllRegisterServer
AtlAxCreateDialogW
AtlComPtrAssign
AtlRegisterClassCategoriesHelper
rasppp
RasCpEnumProtocolIds
RasCpGetInfo
Sections
.EkYmj Size: 1024B - Virtual size: 33KB
IMAGE_SCN_MEM_READ
.text Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.jeRh Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.qory Size: 512B - Virtual size: 191B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.fnTHzA Size: 1024B - Virtual size: 881B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.OMKVe Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 219KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.SnBF Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.iiamrpR Size: 512B - Virtual size: 142B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 210KB - Virtual size: 210KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.uCVnl Size: 1024B - Virtual size: 910B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Icvzd Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.nJgCrv Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.WpujoIn Size: 512B - Virtual size: 217B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE