Static task
static1
Behavioral task
behavioral1
Sample
9fe6c5d9257a85181c673f28361c2a283617c374205f7a54bd6acb7b2baa4984.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9fe6c5d9257a85181c673f28361c2a283617c374205f7a54bd6acb7b2baa4984.exe
Resource
win10v2004-20220812-en
General
-
Target
9fe6c5d9257a85181c673f28361c2a283617c374205f7a54bd6acb7b2baa4984
-
Size
986KB
-
MD5
7d0b0c4f61692a60a67444ee0835225e
-
SHA1
220d14f3ce823cf9c62c436b0273197070cab915
-
SHA256
9fe6c5d9257a85181c673f28361c2a283617c374205f7a54bd6acb7b2baa4984
-
SHA512
0b9eda1d3a54ccdf8c0f6608f0381a0550a3c2bea37057492b64101f187def1ce34390449de3298f27a14b1c7eb7f068f3d3ba5c330909da67194e55efa9b223
-
SSDEEP
24576:cKOaAynmwepBSqNns0YbBBac2izvqflxA7x9Ft6qJBgiyM:OCnmwepdNnsNbmctvCCzYzXM
Malware Config
Signatures
Files
-
9fe6c5d9257a85181c673f28361c2a283617c374205f7a54bd6acb7b2baa4984.exe windows x86
33ee1df416e289ef808384d7e5e07d4e
Code Sign
70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bfCertificate
IssuerOU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=USNot Before29/01/1996, 00:00Not After01/08/2028, 23:59SubjectOU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US68:2b:2c:3c:d8:59:f9:61:d9:21:22:92:a7:2c:20:8bCertificate
IssuerCN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=USNot Before06/10/2009, 00:00Not After10/10/2012, 23:59SubjectCN=LogMeIn\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=LogMeIn\, Inc.,ST=Massachusetts,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate
IssuerOU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=USNot Before21/05/2009, 00:00Not After20/05/2019, 23:59SubjectCN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
4f:da:40:48:55:1a:0f:82:17:50:88:d5:78:1b:74:bc:e1:fe:bd:4dSigner
Actual PE Digest4f:da:40:48:55:1a:0f:82:17:50:88:d5:78:1b:74:bc:e1:fe:bd:4dDigest Algorithmsha1PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=LogMeIn\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=LogMeIn\, Inc.,ST=Massachusetts,C=US06/10/2022, 18:35 Valid: false
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetWindowsDirectoryA
Sleep
CreateDirectoryA
SetCurrentDirectoryA
FindFirstFileA
SetLastError
GetProcAddress
RemoveDirectoryA
GetTempFileNameA
FindClose
FindNextFileA
GetModuleHandleA
GetTempPathA
DeleteFileA
lstrcmpA
lstrlenA
lstrcpynA
LockResource
CloseHandle
lstrcpyA
CreateFileA
FindResourceA
SetFilePointer
FreeResource
LoadResource
WaitForSingleObject
FormatMessageA
WriteFile
SizeofResource
GetFileAttributesA
GetExitCodeProcess
CreateProcessA
lstrcatA
GetLastError
CopyFileA
HeapAlloc
HeapFree
GetProcessHeap
GetStdHandle
ExitProcess
GetStartupInfoA
GetCommandLineA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
RtlUnwind
user32
wvsprintfA
wsprintfA
MessageBoxA
Sections
.text Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 932B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 969KB - Virtual size: 969KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ