Static task
static1
Behavioral task
behavioral1
Sample
4e8641e8579f4a2fb0ad38bc57e6c7e2d216951ea9191c7bbda28bbe12180042.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
4e8641e8579f4a2fb0ad38bc57e6c7e2d216951ea9191c7bbda28bbe12180042.exe
Resource
win10v2004-20220812-en
General
-
Target
4e8641e8579f4a2fb0ad38bc57e6c7e2d216951ea9191c7bbda28bbe12180042
-
Size
305KB
-
MD5
546ca3a27ec043bbbe7f067322937a70
-
SHA1
cad634d3fb6f1b261c1cc162f93a344ebd2aba5f
-
SHA256
4e8641e8579f4a2fb0ad38bc57e6c7e2d216951ea9191c7bbda28bbe12180042
-
SHA512
4b826185fbad2b3cca0a85897ce501842ea9010b9b8c581b1935eef342d17c516c44f72de97be4a895d3d93d1edff8457140570effd8342a4cec640281748efd
-
SSDEEP
6144:8UA7AlvowEueySHm4fbb++uh3i+P4IDj8e:HA7+EuwmyP++u9i+P4Sj8e
Malware Config
Signatures
Files
-
4e8641e8579f4a2fb0ad38bc57e6c7e2d216951ea9191c7bbda28bbe12180042.exe windows x86
fc98d1020c6b9c002990d9307fe26b3f
Code Sign
2a:36:16:b7:04:9a:1c:69:b9:1f:26:f1:b0:1e:84:0aCertificate
IssuerCN=Install-Tech CANot Before28/04/2014, 16:02Not After31/12/2039, 23:59SubjectCN=Install-Techb2:a8:12:19:a9:ba:77:a2:e8:40:b0:9e:a3:53:74:fc:2e:7c:ec:fcSigner
Actual PE Digestb2:a8:12:19:a9:ba:77:a2:e8:40:b0:9e:a3:53:74:fc:2e:7c:ec:fcDigest Algorithmsha1PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=Install-Tech28/10/2022, 15:06 Valid: false
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetFileSize
MapViewOfFile
GetTickCount
Sleep
GetLastError
FreeLibrary
HeapAlloc
HeapFree
GetProcessHeap
LoadLibraryA
GetModuleHandleA
GetTempPathA
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
GetModuleHandleW
VirtualProtect
VirtualFree
GetProcAddress
VirtualAlloc
CloseHandle
GetVersionExW
GetFullPathNameW
CreateFileW
WriteConsoleW
FlushFileBuffers
SetStdHandle
LoadLibraryW
OutputDebugStringW
SetFilePointerEx
GetConsoleCP
LoadLibraryExW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCurrentProcessId
QueryPerformanceCounter
GetFileType
SetFilePointer
ReadConsoleW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
HeapReAlloc
GetSystemTimeAsFileTime
RtlUnwind
GetCommandLineW
RaiseException
InitializeCriticalSectionAndSpinCount
GetCPInfo
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ExitProcess
GetModuleHandleExW
HeapSize
IsDebuggerPresent
GetCurrentThreadId
GetStdHandle
WriteFile
GetModuleFileNameW
IsValidCodePage
GetACP
GetOEMCP
ReadFile
GetConsoleMode
VirtualQuery
user32
MessageBoxW
DestroyWindow
Sections
.text Size: 205KB - Virtual size: 205KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 46KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 14KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ