Static task
static1
Behavioral task
behavioral1
Sample
ee3904c92671f362652bfda68d289600a27c92da7b5ab0b65cc32dbbc66bc776.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
ee3904c92671f362652bfda68d289600a27c92da7b5ab0b65cc32dbbc66bc776.exe
Resource
win10v2004-20220812-en
General
-
Target
ee3904c92671f362652bfda68d289600a27c92da7b5ab0b65cc32dbbc66bc776.com
-
Size
1.5MB
-
MD5
27476932165460a89df23f24bc00fff0
-
SHA1
8aabbdb12a4c6f0a00868163b878e8cc1a25d3a8
-
SHA256
ee3904c92671f362652bfda68d289600a27c92da7b5ab0b65cc32dbbc66bc776
-
SHA512
8da659bfbc867633d99b51e1b35de2ad0201da973548c5c937a1aa7611a296cf387701b912ede038bf1479b74b6194f1c2b8796ccda48fc20592d456aaf5161a
-
SSDEEP
24576:hHVv10WjcOINPF7ZWzYHdA0JdicS3Tjquj7BwVDE5bcjic5VxpTILD2P:hH/0WLI5VrHdTJol3HquXBg+cnj8S
Malware Config
Signatures
Files
-
ee3904c92671f362652bfda68d289600a27c92da7b5ab0b65cc32dbbc66bc776.com.exe windows x86
3c3b24b32cd54387da9d261869ec6fd3
Code Sign
05:2a:5d:8b:4b:46:46:91:50:db:6b:c8:be:a4:86:33Certificate
IssuerCN=DigiCert SHA2 Secure Server CA,O=DigiCert Inc,C=USNot Before25-07-2022 00:00Not After18-08-2023 23:59SubjectCN=www.origin.com,O=Electronic Arts\, Inc.,L=Redwood City,ST=California,C=US7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate
IssuerCN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=USNot Before12-01-2016 00:00Not After11-01-2031 23:59SubjectCN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate
IssuerCN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=USNot Before23-12-2017 00:00Not After22-03-2029 23:59SubjectCN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
64:9b:95:4d:3a:ce:03:a8:1b:63:bf:40:7f:e3:7d:f2:78:e9:bd:ab:31:ba:c8:91:36:9d:34:1a:91:65:22:b9Signer
Actual PE Digest64:9b:95:4d:3a:ce:03:a8:1b:63:bf:40:7f:e3:7d:f2:78:e9:bd:ab:31:ba:c8:91:36:9d:34:1a:91:65:22:b9Digest Algorithmsha256PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=www.origin.com,O=Electronic Arts\, Inc.,L=Redwood City,ST=California,C=US13-10-2022 14:25 Valid: false
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
AcquireSRWLockShared
CloseHandle
LoadResource
SetWaitableTimer
MulDiv
SetEvent
CreateWaitableTimerW
GenerateConsoleCtrlEvent
GetConsoleWindow
GetConsoleAliasesA
GetHandleInformation
GetCommandLineW
GetDllDirectoryA
ResetWriteWatch
SetCommBreak
ClearCommError
FreeLibrary
EnumResourceNamesA
GetConsoleCP
GetFileSizeEx
ExitProcess
LoadLibraryW
SuspendThread
GetCurrentThread
GetThreadLocale
GetStringTypeW
GetWindowsDirectoryW
HeapCreate
GetSystemInfo
SetStdHandle
SetFilePointer
FlushFileBuffers
GetShortPathNameW
GetProcAddress
GetModuleHandleW
SetConsoleCP
LocalAlloc
HeapSize
LoadLibraryA
RaiseException
GetCommandLineA
GetStartupInfoA
GetModuleHandleA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
GetLastError
Sleep
MultiByteToWideChar
ReadConsoleInputA
ReadConsoleInputW
SetConsoleMode
GetConsoleMode
WideCharToMultiByte
HeapFree
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
WriteFile
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
LCMapStringW
GetStringTypeA
GetLocaleInfoA
HeapAlloc
HeapReAlloc
CreateFileA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
VirtualAlloc
InitializeCriticalSectionAndSpinCount
RtlUnwind
ReadFile
user32
GetClipboardOwner
GetDlgItemTextW
LoadMenuA
MessageBoxW
SetScrollInfo
gdi32
GetFontLanguageInfo
GetDIBColorTable
comdlg32
PrintDlgA
ole32
CoRevertToSelf
OleBuildVersion
oleaut32
SysAllocString
SysFreeString
Sections
.text Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ