Static task
static1
Behavioral task
behavioral1
Sample
238392c6d1244c887d99e923dbb71c98e80101627e61aabbf75adcc2be7f5573.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
238392c6d1244c887d99e923dbb71c98e80101627e61aabbf75adcc2be7f5573.exe
Resource
win10v2004-20220812-en
General
-
Target
238392c6d1244c887d99e923dbb71c98e80101627e61aabbf75adcc2be7f5573
-
Size
429KB
-
MD5
84e7960da8d50f3eec92733b9ebe5907
-
SHA1
6f9f5a989ad80177c795e9881f4c9be48846b7f5
-
SHA256
238392c6d1244c887d99e923dbb71c98e80101627e61aabbf75adcc2be7f5573
-
SHA512
125936d5a8151518197e34a37f16503683470d20a53321abb3b4b0e26fa81cd6e5ae050945a09b28f9104630b643008d8c8379bd32bf38ae9860f26a25b44feb
-
SSDEEP
6144:zkRz3aOOH3cSclc/6BuVnzhbw6B76BptbESqDSNFd7hqnebn8yGSnMyQ:g5YH3/KuVzh9WjdSMf7h8Gn8yT9Q
Malware Config
Signatures
Files
-
238392c6d1244c887d99e923dbb71c98e80101627e61aabbf75adcc2be7f5573.exe windows x86
68ec78db1da3af8f05ee89a28e23d86f
Code Sign
4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3Certificate
IssuerOU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust NetworkNot Before12/05/1997, 00:00Not After07/01/2004, 23:59SubjectOU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9dCertificate
IssuerOU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust NetworkNot Before28/02/2001, 00:00Not After06/01/2004, 23:59SubjectCN=VeriSign Time Stamping Service,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)01,O=VeriSign\, Inc.Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate
IssuerCN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft CorporationNot Before10/01/1997, 07:00Not After31/12/2020, 07:00SubjectCN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation6a:0b:99:4f:c0:00:de:aa:11:d4:d8:40:9a:a8:be:e6Certificate
IssuerCN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft CorporationNot Before10/12/2000, 08:00Not After12/11/2005, 08:00SubjectCN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign
61:07:11:43:00:00:00:00:00:34Certificate
IssuerCN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before25/05/2002, 00:55Not After25/11/2003, 01:05SubjectCN=Microsoft Corporation,OU=Copyright (c) 2002 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
15:e3:99:ae:09:fd:76:2e:1c:02:8f:68:50:73:be:44:29:76:12:90Signer
Actual PE Digest15:e3:99:ae:09:fd:76:2e:1c:02:8f:68:50:73:be:44:29:76:12:90Digest Algorithmsha1PE Digest MatchesfalseSignature Validations
TrustedfalseVerification
Signing CertificateCN=Microsoft Corporation,OU=Copyright (c) 2002 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US28/10/2022, 15:06 Valid: false
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
WaitForSingleObject
CreateSemaphoreW
ReleaseSemaphore
GetCommandLineW
SetUnhandledExceptionFilter
DeleteFileW
GetProcAddress
LoadLibraryA
FreeLibrary
GetModuleFileNameW
GetModuleHandleA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
RaiseException
InterlockedExchange
LocalAlloc
GetLocaleInfoW
GlobalFree
GetLastError
GlobalAlloc
TlsSetValue
TlsGetValue
GetStartupInfoA
user32
SetWindowPos
IsZoomed
SetForegroundWindow
MapVirtualKeyW
LoadIconW
GetSystemMetrics
LoadImageW
IsIconic
UpdateWindow
GetDesktopWindow
GetParent
PostMessageW
GetWindowPlacement
SetWindowPlacement
ShowWindow
IsWindow
DestroyWindow
msocf
?CreateTheApp@Framework@Jot@@YGXPAUHINSTANCE__@@PAUAFrameAppUser@2@PAUAMsoClientUser@2@PBG_NPA_NPAPAUHWND__@@H3PAU_MSOREGLANG@@4@Z
?TheApp@Framework@Jot@@YGPAUAFrameApp@2@XZ
??0CToolbarData@Jot@@QAE@XZ
?Init@CToolbarData@Jot@@QAGXPBUStaticToolbarDesc@2@IPBUStaticMenuDesc@2@I@Z
?TerminateTheApp@Framework@Jot@@YGXXZ
?Finish@Framework@Jot@@YGXXZ
??1CToolbarData@Jot@@QAE@XZ
?Start@Framework@Jot@@YGXXZ
msocfu
?g_FastBufferAllocator@Jot@@3VCFastBufferAllocator@1@A
?g_FixedBufferAllocator@Jot@@3VCFixedBufferAllocator@1@A
?SetWzFromNumber@Strings@Jot@@YGXAAV?$CWzInBuffer_Template@V?$CBuffer@G@Jot@@@2@IHHPAH@Z
?FreeRgbCbCore@Memory@Jot@@YGXPAEH@Z
?AppendArrayOfCharactersToWz@Strings@Jot@@YGXPBGHAAV?$CWzInBuffer_Template@V?$CBuffer@G@Jot@@@2@PAH@Z
?SetWzFromResource@Strings@Jot@@YGXAAV?$CWzInBuffer_Template@V?$CBuffer@G@Jot@@@2@PAUHINSTANCE__@@IPAH@Z
?SetWtzFromPattern@Strings@Jot@@YGXAAV?$CWtzInBuffer_Template@V?$CBuffer@G@Jot@@@2@PAUHINSTANCE__@@IQAPBGH@Z
?SetWzFromPattern@Strings@Jot@@YGXAAV?$CWzInBuffer_Template@V?$CBuffer@G@Jot@@@2@PAUHINSTANCE__@@IQAPBGHPAH@Z
?CreateActionManager@Jot@@YGXPAPAUIActionMan@1@@Z
?CopyWzToWz@Strings@Jot@@YGXPBGAAV?$CWzInBuffer_Template@V?$CBuffer@G@Jot@@@2@PAH@Z
?InitJotUtil@Jot@@YGXHPAU_msotcfcf@@@Z
?UsePropertyInfo@Properties@Jot@@YGPBUPropertyInfo@2@I@Z
?TheActionManager@Jot@@YGPAUIActionMan@1@XZ
?Set@Properties@Jot@@YGXPAUIPropertySet@2@PBUPropertyInfo@2@PBXW4PropertyType@2@@Z
?TheEmptyWz@Jot@@YGPBGXZ
oisapp
?DoSendToMode@COISApp@@QAEXABUDownloadSettings@@@Z
?DoDownloadMode@COISApp@@QAEXAAUDownloadSettings@@@Z
?DoUploadMode@COISApp@@QAEXABV?$TObjArray@VCVarStr@Ofc@@@Ofc@@@Z
?DoBrowseMode@COISApp@@SAXABV?$TObjArray@VCVarStr@Ofc@@@Ofc@@@Z
?DoNormalMode@COISApp@@SAXXZ
?FDoShutdown@OISAppApi@@YG_NXZ
?CdlDoEvent@OISAppApi@@YG_NAAUtagMSG@@@Z
?RFMDisableApp@COISApp@@QAEXXZ
?CdlWorkPaneCallback@OISAppApi@@YIHHHPAX00@Z
?GetRootCollection@CAppOA@@SAXPAPBG@Z
?Singleton@CAppOA@@SAPAV1@XZ
?DoEditMode@COISApp@@QAEXABV?$TObjArray@VCVarStr@Ofc@@@Ofc@@_N@Z
?InitInstance@OISAppApi@@YGXPAUMSOINST@@PAUHINSTANCE__@@@Z
?SetContextMenuCallback@OISAppApi@@YGXP6IXHABUtagPOINT@@H@Z@Z
?SetShowToolbar@OISAppApi@@YGXP6IXH@Z@Z
?GetOISSelectionContext@OISAppApi@@YGXPAPAUIContext@Jot@@@Z
?SetTestWizardInfo@COISApp@@SAJKUtagVARIANT@@@Z
?GetTestWizardInfo@COISApp@@SAXW4TestWizardRequestedItem@@PAXPAUtagPOINT@@@Z
?OnSetFocus@OISAppApi@@YGXXZ
?CreateMediaWindow@OISAppApi@@YGPAUHWND__@@PAU2@@Z
?ExitInstance@OISAppApi@@YGXXZ
?CdlDoIdle@OISAppApi@@YGXXZ
?GetApp@OISAppApi@@YGPAVCOISApp@@XZ
?DgRedEyePaneDialog@OISAppApi@@YGPAVDLDialog@Ofc@@AAUICdlContext@3@@Z
?DgRotatePaneDialog@OISAppApi@@YGPAVDLDialog@Ofc@@AAUICdlContext@3@@Z
?DgHueSatPaneDialog@OISAppApi@@YGPAVDLDialog@Ofc@@AAUICdlContext@3@@Z
?DgBrightContrastPaneDialog@OISAppApi@@YGPAVDLDialog@Ofc@@AAUICdlContext@3@@Z
?DgCropPaneDialog@OISAppApi@@YGPAVDLDialog@Ofc@@AAUICdlContext@3@@Z
?DgFileFormatOptDialog@OISAppApi@@YGPAVDLDialog@Ofc@@AAUICdlContext@3@@Z
?DgEditHomeDialog@OISAppApi@@YGPAVDLDialog@Ofc@@AAUICdlContext@3@@Z
?DgNavigationPaneDialog@OISAppApi@@YGPAVDLDialog@Ofc@@AAUICdlContext@3@@Z
?DgPublishDialog@OISAppApi@@YGPAVDLDialog@Ofc@@AAUICdlContext@3@@Z
?DgRenamePaneDialog@OISAppApi@@YGPAVDLDialog@Ofc@@AAUICdlContext@3@_N@Z
?DgUploadDialog@OISAppApi@@YGPAVDLDialog@Ofc@@AAUICdlContext@3@@Z
?DgEditModeButtonBar@OISAppApi@@YGPAVDLDialog@Ofc@@AAUICdlContext@3@@Z
?DgUploadModeButtonBar@OISAppApi@@YGPAVDLDialog@Ofc@@AAUICdlContext@3@@Z
?DgCompressPicsDialog@OISAppApi@@YGPAVDLDialog@Ofc@@AAUICdlContext@3@@Z
?DgResizeDialog@OISAppApi@@YGPAVDLDialog@Ofc@@AAUICdlContext@3@_N@Z
?DgLocatePicturesDialog@OISAppApi@@YGPAVDLDialog@Ofc@@AAUICdlContext@3@@Z
?DgHomeDialog@OISAppApi@@YGPAVDLDialog@Ofc@@AAUICdlContext@3@@Z
?DgEmailDialog@OISAppApi@@YGPAVDLDialog@Ofc@@AAUICdlContext@3@@Z
?DgPropertiesPaneDialog@OISAppApi@@YGPAVDLDialog@Ofc@@AAUICdlContext@3@@Z
?SetFrameHwnd@OISAppApi@@YGXPAUHWND__@@@Z
?GetCDLContext@OISAppApi@@YGPAUICdlContext@Ofc@@XZ
msvcrt
_controlfp
_CxxThrowException
memmove
__dllonexit
_onexit
_c_exit
_exit
_XcptFilter
_ismbblead
_cexit
exit
_acmdln
_amsg_exit
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
??1type_info@@UAE@XZ
__CxxFrameHandler
Sections
.text Size: 54KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 36B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 212KB - Virtual size: 211KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ