Behavioral task
behavioral1
Sample
86d2067d6e41794185b29cff8b16f6408337ca52828972394cfa91824e06935b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
86d2067d6e41794185b29cff8b16f6408337ca52828972394cfa91824e06935b.exe
Resource
win10v2004-20220901-en
General
-
Target
86d2067d6e41794185b29cff8b16f6408337ca52828972394cfa91824e06935b
-
Size
33KB
-
MD5
05e7845ff746f2fad320b7fd336af640
-
SHA1
af0dc6403989c8a6f637748ef315438354b65f44
-
SHA256
86d2067d6e41794185b29cff8b16f6408337ca52828972394cfa91824e06935b
-
SHA512
a5a1341ba097059e9dc300dc6475bd14664bf007d9b453b1ec5d8779edd216a773b72a755505751f5665f4a00a02d48d76f48ba8ef378d0af247892ff833fe21
-
SSDEEP
768:+NN/CbFGGnuUyXPNnbcuyD7UEh7WQMTNnkKsXmYPyRQKLf:g6hGMyfNnouy8Eh6JnkKs2Y6RQKz
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
86d2067d6e41794185b29cff8b16f6408337ca52828972394cfa91824e06935b.exe windows x86
Code Sign
32:25:fb:5a:95:d0:75:82:45:45:99:be:4e:85:fb:b1Certificate
IssuerCN=VeriSign Class 3 Code Signing 2009 CANot Before17-10-2009 16:00Not After18-10-2012 16:00SubjectCN=Games Software Helper Tools23:35:a9:ef:3a:6f:3d:64:b1:cf:8d:1f:62:ad:bd:a0Certificate
IssuerCN=VeriSign Class 3 Code Signing 2009 CANot Before30-09-1999 16:00Not After16-07-2036 16:00SubjectCN=VeriSign Class 3 Code Signing 2009 CA38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before15-06-2007 00:00Not After14-06-2012 23:59SubjectCN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04-12-2003 00:00Not After03-12-2013 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
d3:7d:f9:f4:16:a6:bf:c0:c8:29:6e:5e:ff:35:ea:56:d6:d6:6d:a8Signer
Actual PE Digestd3:7d:f9:f4:16:a6:bf:c0:c8:29:6e:5e:ff:35:ea:56:d6:d6:6d:a8Digest Algorithmsha1PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=Games Software Helper Tools07-06-2011 02:26 Valid: false
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 56KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 11KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 17KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE