Static task
static1
Behavioral task
behavioral1
Sample
90a281cfb7327f8b146df27f89820fdb104ef654f6d8f7e74dca2a334bc661bc.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
90a281cfb7327f8b146df27f89820fdb104ef654f6d8f7e74dca2a334bc661bc.exe
Resource
win10v2004-20221111-en
General
-
Target
90a281cfb7327f8b146df27f89820fdb104ef654f6d8f7e74dca2a334bc661bc
-
Size
2.3MB
-
MD5
ab6da63c9ae98e23f9595142b45231b6
-
SHA1
9f09864e12d01d30dd71377b83549b8cd56fc484
-
SHA256
90a281cfb7327f8b146df27f89820fdb104ef654f6d8f7e74dca2a334bc661bc
-
SHA512
b13c489d9cefc07adee08028bd3d453fa7f9231c782d04ecd86e0de8a5169a94da0926e62ad23d58e31c1891dca31d7a918c5374e8483a2a78568e684554f906
-
SSDEEP
49152:QEZJxHqXcKIx8ggcgPpQdxr7zKycAMT6sluuuuuuuuuuuuuuuuuuuuuuuuuuuuui:QE7xHqs/Ojaxr7z/cApauuuuuuuuuuuy
Malware Config
Signatures
Files
-
90a281cfb7327f8b146df27f89820fdb104ef654f6d8f7e74dca2a334bc661bc.exe windows x86
3f1889d4f1ff039e003ed80bc9c402c3
Code Sign
70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bfCertificate
IssuerOU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=USNot Before29-01-1996 00:00Not After01-08-2028 23:59SubjectOU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04-12-2003 00:00Not After03-12-2013 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88Certificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before04-12-2003 00:00Not After03-12-2008 23:59SubjectCN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate
IssuerOU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=USNot Before16-07-2004 00:00Not After15-07-2014 23:59SubjectCN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
7b:76:16:97:9c:e3:8e:3c:a3:8d:51:48:24:5c:33:6bCertificate
IssuerCN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=USNot Before01-11-2006 00:00Not After10-12-2007 23:59SubjectCN=Adobe Systems Incorporated,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Information Systems,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
83:28:0a:ca:00:14:0f:60:c4:b0:43:af:ee:81:bf:c6:d5:56:ae:4dSigner
Actual PE Digest83:28:0a:ca:00:14:0f:60:c4:b0:43:af:ee:81:bf:c6:d5:56:ae:4dDigest Algorithmsha1PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=Adobe Systems Incorporated,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Information Systems,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US17-11-2022 13:13 Valid: false
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
wininet
HttpQueryInfoA
crypt32
CertFreeCertificateContext
CertVerifySubjectCertificateContext
CertFindCertificateInStore
CertCreateCertificateContext
CryptGetMessageCertificates
CryptVerifyMessageSignature
CertCloseStore
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
winmm
waveInOpen
waveOutOpen
waveOutClose
waveOutUnprepareHeader
waveOutReset
waveOutWrite
waveOutPrepareHeader
waveOutGetDevCapsA
timeBeginPeriod
timeGetDevCaps
waveInGetDevCapsA
waveOutGetNumDevs
waveInGetNumDevs
waveInStart
waveInAddBuffer
waveInStop
waveInClose
waveInUnprepareHeader
waveInReset
waveInPrepareHeader
timeKillEvent
timeSetEvent
timeGetTime
timeEndPeriod
oleaut32
SysFreeString
kernel32
GetSystemInfo
GetUserDefaultLangID
ExitThread
GlobalFree
GetFileAttributesW
WriteFile
SetFilePointer
CreateFileA
LockResource
LoadResource
FindResourceExA
FindResourceExW
GlobalAlloc
CreateThread
SetUnhandledExceptionFilter
GetTempPathA
GetCurrentProcess
GetCurrentProcessId
FindClose
FindNextFileA
FindFirstFileA
GetTimeZoneInformation
GetSystemTime
SystemTimeToFileTime
WideCharToMultiByte
CreateDirectoryA
ReadFile
GetFileSize
GetModuleFileNameA
CreateMutexA
GetFileAttributesExA
GetCurrentDirectoryA
SetCurrentDirectoryA
VirtualQuery
GetTempFileNameA
GetFullPathNameA
GetSystemDirectoryA
UnmapViewOfFile
WaitForSingleObject
ReleaseMutex
MapViewOfFile
CreateFileMappingA
lstrcpyA
lstrlenA
InterlockedDecrement
InterlockedIncrement
GlobalUnlock
GlobalLock
IsDBCSLeadByteEx
DeleteFileW
SetEndOfFile
SetFileAttributesA
CopyFileA
GetCommandLineW
GetModuleHandleA
ExitProcess
GetStartupInfoA
GetCommandLineA
GetProcessTimes
CreateEventA
SetEvent
SetThreadPriority
ResetEvent
WaitForMultipleObjects
VirtualFree
VirtualAlloc
GetThreadPriority
GetCurrentThread
GetFileAttributesA
DeleteFileA
MoveFileA
GetSystemDefaultLangID
FreeLibrary
GetLastError
GetVersionExA
CreateProcessA
CloseHandle
LCMapStringW
LCMapStringA
GetTickCount
GetCurrentThreadId
GetLocaleInfoA
SetErrorMode
QueryPerformanceCounter
QueryPerformanceFrequency
HeapAlloc
GetProcessHeap
LoadLibraryA
GetProcAddress
IsDBCSLeadByte
GetACP
GetCPInfo
MultiByteToWideChar
InterlockedExchange
InterlockedCompareExchange
Sleep
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
HeapFree
VirtualProtect
HeapReAlloc
TerminateProcess
HeapSize
GetSystemTimeAsFileTime
RtlUnwind
SetLastError
GetStdHandle
GetOEMCP
GetStringTypeA
GetStringTypeW
RemoveDirectoryA
user32
UnregisterClassA
LoadStringW
MoveWindow
SetMenu
UpdateWindow
ShowWindow
EnumDisplaySettingsA
SetDlgItemTextA
SetDlgItemTextW
EnableWindow
GetDlgItemTextA
GetWindowTextLengthA
GetDlgItemTextW
GetWindowTextLengthW
PostQuitMessage
GetMenuStringA
GetMenuStringW
RegisterClassA
DispatchMessageA
TranslateMessage
TranslateAcceleratorA
GetMessageA
LoadAcceleratorsA
PostThreadMessageA
GetQueueStatus
PeekMessageA
MsgWaitForMultipleObjects
RegisterWindowMessageA
GetWindow
RemoveMenu
InsertMenuW
InsertMenuA
EmptyClipboard
SetClipboardData
OpenClipboard
IsClipboardFormatAvailable
GetClipboardData
CloseClipboard
RegisterClipboardFormatA
CreateWindowExA
GetWindowLongA
DefWindowProcA
IsWindow
GetMenuItemID
DeleteMenu
ClientToScreen
TrackPopupMenu
SetCapture
ReleaseCapture
GetCapture
WindowFromPoint
GetFocus
DestroyWindow
GetMenu
BeginPaint
EndPaint
LoadCursorA
SetCursor
GetCursorPos
ScreenToClient
GetClientRect
KillTimer
SetTimer
LoadMenuA
GetSubMenu
DestroyMenu
LoadStringA
EnableMenuItem
CheckMenuItem
InvalidateRect
MapVirtualKeyA
GetKeyState
FillRect
GetForegroundWindow
WaitForInputIdle
DialogBoxParamW
DialogBoxParamA
MessageBoxA
SystemParametersInfoA
DialogBoxIndirectParamW
DialogBoxIndirectParamA
PostMessageA
EndDialog
SetWindowLongA
GetParent
GetWindowRect
GetDesktopWindow
SetWindowPos
GetDlgItem
SendMessageA
SetWindowTextA
SetFocus
GetMenuItemCount
GetMenuItemInfoA
GetSystemMetrics
InsertMenuItemA
GetDC
ReleaseDC
DdeInitializeA
DdeCreateStringHandleA
DdeConnect
DdeClientTransaction
DdeDisconnect
DdeFreeStringHandle
DdeUninitialize
SendInput
GetKeyboardLayout
GetDoubleClickTime
LoadIconA
gdi32
BitBlt
SelectObject
RealizePalette
SelectPalette
GetStockObject
CreateFontIndirectA
SetBkMode
SetTextAlign
IntersectClipRect
SelectClipRgn
ExtTextOutA
ExtTextOutW
SetTextColor
GetTextMetricsA
GetTextAlign
GetBkMode
GetTextColor
EnumFontFamiliesA
SetTextCharacterExtra
GetDeviceCaps
CreateRectRgn
DPtoLP
GetTextExtentPoint32W
GetCurrentObject
SetBkColor
GetBkColor
CreatePen
GetTextExtentPoint32A
CreatePalette
EndPage
BeginPath
EndPath
GetSystemPaletteEntries
GetClipBox
CreateSolidBrush
LPtoDP
StartDocA
EndDoc
StrokePath
ExtCreatePen
FillPath
StretchDIBits
CreateDCA
GetObjectA
RestoreDC
SaveDC
SelectClipPath
CreateCompatibleBitmap
GetDIBits
CreateDIBSection
DeleteDC
CreateCompatibleDC
GdiFlush
GetClipRgn
StartPage
PolyBezierTo
LineTo
MoveToEx
SetPolyFillMode
DeleteObject
comdlg32
GetOpenFileNameA
PrintDlgA
GetOpenFileNameW
GetSaveFileNameW
CommDlgExtendedError
GetSaveFileNameA
advapi32
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegCreateKeyExA
shell32
DragQueryFileA
SHGetSpecialFolderLocation
SHBrowseForFolderA
DragQueryFileW
SHGetPathFromIDListA
SHAppBarMessage
DragAcceptFiles
ole32
CoFreeUnusedLibraries
CoInitialize
CoUninitialize
CoTaskMemFree
CoCreateInstance
CoTaskMemAlloc
wsock32
WSAStartup
ntohl
inet_ntoa
socket
select
gethostname
recvfrom
inet_addr
ntohs
sendto
WSACancelAsyncRequest
WSAAsyncGetHostByName
WSAAsyncSelect
WSAGetLastError
send
recv
closesocket
htons
ioctlsocket
gethostbyname
htonl
connect
setsockopt
WSACleanup
Sections
.text Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 160KB - Virtual size: 157KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 212KB - Virtual size: 1003KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 128KB - Virtual size: 127KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ