Static task
static1
Behavioral task
behavioral1
Sample
bbfffb8506508664f7b13a10d1e1a141b19a0dbe58fe572b948021b1f3c35cf6.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
bbfffb8506508664f7b13a10d1e1a141b19a0dbe58fe572b948021b1f3c35cf6.exe
Resource
win10-20220812-en
General
-
Target
bbfffb8506508664f7b13a10d1e1a141b19a0dbe58fe572b948021b1f3c35cf6
-
Size
1.5MB
-
MD5
0d9fd6c5ae1bb01935cacc797a08a3db
-
SHA1
e7e60d3310c7a15a376822b67969c4c2e8a03167
-
SHA256
bbfffb8506508664f7b13a10d1e1a141b19a0dbe58fe572b948021b1f3c35cf6
-
SHA512
bfeffe61008d79e1e9e9388b2ef52768a42d9458317ba9acde2596ad65916f3cade172d23f986fee11113406e0f6a9191f5fd2d366d8212eb741afa87197c86e
-
SSDEEP
24576:bDswIUcg0Y3P30K5UPshpyPNOAhYptMb3acsXq0QjRlL9mKOzINBfA65Bke:bDI4cK9+Plo2RlL9IkBI65d
Malware Config
Signatures
Files
-
bbfffb8506508664f7b13a10d1e1a141b19a0dbe58fe572b948021b1f3c35cf6.exe windows x86
d8761a1f54b24cb5e90225a4de0f3bda
Code Sign
03:13:a1:b7:fd:65:72:db:4d:90:23:c1:a7:df:60:73:36:72Certificate
IssuerCN=R3,O=Let's Encrypt,C=USNot Before22/09/2022, 14:34Not After21/12/2022, 14:34SubjectCN=booper.com7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate
IssuerCN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=USNot Before12/01/2016, 00:00Not After11/01/2031, 23:59SubjectCN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate
IssuerCN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=USNot Before23/12/2017, 00:00Not After22/03/2029, 23:59SubjectCN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
a8:7e:eb:dc:b0:cc:10:1c:79:d3:ea:ea:a6:a6:00:d1:4a:34:a4:b6:74:72:d8:b3:97:4d:e1:39:45:28:d8:edSigner
Actual PE Digesta8:7e:eb:dc:b0:cc:10:1c:79:d3:ea:ea:a6:a6:00:d1:4a:34:a4:b6:74:72:d8:b3:97:4d:e1:39:45:28:d8:edDigest Algorithmsha256PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=booper.com09/10/2022, 20:18 Valid: false
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ExitProcess
GetTickCount
FindResourceExW
GetProcAddress
GlobalAlloc
ConvertFiberToThread
DeleteAtom
SetCommConfig
SetCommMask
EraseTape
CreateWaitableTimerExW
GetPrivateProfileIntW
GetDllDirectoryW
CreateHardLinkW
FindNextFileNameW
SetCalendarInfoA
EnumSystemGeoID
GetSystemDefaultLangID
ReadConsoleInputW
GetConsoleAliasesA
ReleaseMutex
ReleaseSRWLockExclusive
AcquireSRWLockShared
SetLastError
LoadLibraryA
GetLastError
ReadFile
SetEndOfFile
WriteConsoleW
MultiByteToWideChar
HeapAlloc
RaiseException
GetCommandLineW
InterlockedIncrement
InterlockedDecrement
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCurrentThreadId
EncodePointer
DecodePointer
GetModuleHandleExW
AreFileApisANSI
GetStdHandle
WriteFile
GetModuleFileNameW
GetProcessHeap
IsDebuggerPresent
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
HeapFree
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
Sleep
RtlUnwind
VirtualQuery
GetFileType
InitOnceExecuteOnce
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount64
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetCurrentProcess
TerminateProcess
GetModuleHandleW
WideCharToMultiByte
GetStringTypeW
LoadLibraryExW
OutputDebugStringW
LoadLibraryW
CloseHandle
HeapReAlloc
GetConsoleCP
GetConsoleMode
SetFilePointerEx
LCMapStringEx
HeapSize
FlushFileBuffers
SetStdHandle
CreateFileW
ReadConsoleW
gdi32
CreateDCW
SetAbortProc
advapi32
CloseEventLog
OpenBackupEventLogA
oleaut32
SysAllocString
SysFreeString
Sections
.text Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ