Static task
static1
Behavioral task
behavioral1
Sample
61dd5d6bb55760610c0bb9bd2a276f10bf9de7118d6991ba62b4246b5e8621f8.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
61dd5d6bb55760610c0bb9bd2a276f10bf9de7118d6991ba62b4246b5e8621f8.exe
Resource
win10v2004-20220901-en
General
-
Target
61dd5d6bb55760610c0bb9bd2a276f10bf9de7118d6991ba62b4246b5e8621f8
-
Size
936KB
-
MD5
83886a33b7b682a23b68fff233edff50
-
SHA1
0e78ea3d1251da29ab9ce8184b39a7f0e080cc8c
-
SHA256
61dd5d6bb55760610c0bb9bd2a276f10bf9de7118d6991ba62b4246b5e8621f8
-
SHA512
49647b07742dc26058406723164a212f7d701421c9241ac1009c13b4e332476edf4acf762a1e00ffd4f1bd1c86d1148b469728f8eda9bbb5562ad7c8e9908171
-
SSDEEP
24576:Ps/Z9arRbSnCS/ZmExYaEsAGSTU9twGTdK8kUu1hLMP2:4CFbSCSIEiLsA+92udK8bK62
Malware Config
Signatures
Files
-
61dd5d6bb55760610c0bb9bd2a276f10bf9de7118d6991ba62b4246b5e8621f8.exe windows x86
33ee1df416e289ef808384d7e5e07d4e
Code Sign
70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bfCertificate
IssuerOU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=USNot Before29-01-1996 00:00Not After01-08-2028 23:59SubjectOU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US68:2b:2c:3c:d8:59:f9:61:d9:21:22:92:a7:2c:20:8bCertificate
IssuerCN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=USNot Before06-10-2009 00:00Not After10-10-2012 23:59SubjectCN=LogMeIn\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=LogMeIn\, Inc.,ST=Massachusetts,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate
IssuerOU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=USNot Before21-05-2009 00:00Not After20-05-2019 23:59SubjectCN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
3d:78:a8:5f:23:d1:c7:f7:0d:c8:67:1f:89:b9:e7:1f:f8:6f:38:21Signer
Actual PE Digest3d:78:a8:5f:23:d1:c7:f7:0d:c8:67:1f:89:b9:e7:1f:f8:6f:38:21Digest Algorithmsha1PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=LogMeIn\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=LogMeIn\, Inc.,ST=Massachusetts,C=US28-10-2022 15:02 Valid: false
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetWindowsDirectoryA
Sleep
CreateDirectoryA
SetCurrentDirectoryA
FindFirstFileA
SetLastError
GetProcAddress
RemoveDirectoryA
GetTempFileNameA
FindClose
FindNextFileA
GetModuleHandleA
GetTempPathA
DeleteFileA
lstrcmpA
lstrlenA
lstrcpynA
LockResource
CloseHandle
lstrcpyA
CreateFileA
FindResourceA
SetFilePointer
FreeResource
LoadResource
WaitForSingleObject
FormatMessageA
WriteFile
SizeofResource
GetFileAttributesA
GetExitCodeProcess
CreateProcessA
lstrcatA
GetLastError
CopyFileA
HeapAlloc
HeapFree
GetProcessHeap
GetStdHandle
ExitProcess
GetStartupInfoA
GetCommandLineA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
RtlUnwind
user32
wvsprintfA
wsprintfA
MessageBoxA
Sections
.text Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 932B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 919KB - Virtual size: 918KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ