Static task
static1
Behavioral task
behavioral1
Sample
4d9ca052a45d3b3cf3f995c5e070532f38c8c6f8817b8f008b7820b5d25152a4.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
4d9ca052a45d3b3cf3f995c5e070532f38c8c6f8817b8f008b7820b5d25152a4.exe
Resource
win10-20220812-en
General
-
Target
4d9ca052a45d3b3cf3f995c5e070532f38c8c6f8817b8f008b7820b5d25152a4
-
Size
1.2MB
-
MD5
49128d358b90e7110e9f792e247d1db2
-
SHA1
da15de46c60bafa8493f3ebf65c6455230c0f7fb
-
SHA256
4d9ca052a45d3b3cf3f995c5e070532f38c8c6f8817b8f008b7820b5d25152a4
-
SHA512
1f524959ef6788adf7da27c2fc847d15b404e740d56f9e92f388e23070f6bb0c8881c08e114590a966d4a0240368bd9dbd423318eac86935845fa85def0bfce4
-
SSDEEP
24576:AyTsIIQSREBz3op/xkIQKHmQGtaduEKq4:AyHSRLxkhVQGyhKq
Malware Config
Signatures
Files
-
4d9ca052a45d3b3cf3f995c5e070532f38c8c6f8817b8f008b7820b5d25152a4.exe windows x86
732f4cfdca2cfdac9ecb5aaba5b9fdb5
Code Sign
5b:0b:4c:d6:7f:a7:69:78Certificate
IssuerCN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=USNot Before27-06-2022 08:21Not After28-06-2023 11:01SubjectCN=*.bayt.com,O=BAYT.COM INC,L=Dubai,ST=Dubai,C=AE7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate
IssuerCN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=USNot Before12-01-2016 00:00Not After11-01-2031 23:59SubjectCN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate
IssuerCN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=USNot Before23-12-2017 00:00Not After22-03-2029 23:59SubjectCN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
a8:0e:67:37:b5:00:b2:9f:21:dd:48:8a:e9:2d:02:85:10:49:f5:74:3b:52:1a:0a:a9:dc:bb:88:cb:1d:f9:daSigner
Actual PE Digesta8:0e:67:37:b5:00:b2:9f:21:dd:48:8a:e9:2d:02:85:10:49:f5:74:3b:52:1a:0a:a9:dc:bb:88:cb:1d:f9:daDigest Algorithmsha256PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=*.bayt.com,O=BAYT.COM INC,L=Dubai,ST=Dubai,C=AE17-11-2022 07:42 Valid: false
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateFileW
lstrcmpiW
CloseHandle
SetStdHandle
IsProcessorFeaturePresent
FlushFileBuffers
LoadLibraryA
GetDiskFreeSpaceW
GetProcAddress
GetLastError
lstrcmpW
RaiseException
GlobalAlloc
MultiByteToWideChar
MoveFileA
EnterCriticalSection
LeaveCriticalSection
DeleteFileA
GetCommandLineW
HeapSetInformation
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
DecodePointer
EncodePointer
GetModuleFileNameW
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
GetCurrentThreadId
TlsFree
GetModuleHandleW
SetLastError
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
HeapValidate
IsBadReadPtr
ExitProcess
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
WriteFile
GetStringTypeW
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
LoadLibraryW
RtlUnwind
WideCharToMultiByte
LCMapStringW
SetFilePointer
GetConsoleCP
GetConsoleMode
HeapAlloc
GetModuleFileNameA
HeapReAlloc
HeapSize
HeapQueryInformation
HeapFree
user32
GetMessageW
LoadCursorW
GetDC
TranslateMessage
LoadIconW
ShowWindow
CreateWindowExW
RegisterClassW
DispatchMessageW
gdi32
CreateFontW
ChoosePixelFormat
SetPixelFormat
GetStockObject
CreateSolidBrush
DeleteObject
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ