Static task
static1
Behavioral task
behavioral1
Sample
f7f47bc3421b0a7d260d24c4742e7d6a2d8a2e79898997db88a5aac4f5ced136.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f7f47bc3421b0a7d260d24c4742e7d6a2d8a2e79898997db88a5aac4f5ced136.exe
Resource
win10v2004-20220901-en
General
-
Target
f7f47bc3421b0a7d260d24c4742e7d6a2d8a2e79898997db88a5aac4f5ced136
-
Size
568KB
-
MD5
0eaee80c6c081e6bd04d5126467f007c
-
SHA1
cffb2257aab9868c7b2d71462d4cdc3ae1e55a97
-
SHA256
f7f47bc3421b0a7d260d24c4742e7d6a2d8a2e79898997db88a5aac4f5ced136
-
SHA512
6333efcceb377cdf557d3b4f9c5a8ec5430052f95a633786dde941f525b04750f61f511bf7c3f64ca88526b87ef68d9447e9eb9783b9956b5fe13b0f87b10bd5
-
SSDEEP
12288:xiQobmPYDqHinL62tFl1GwH5Gf2RwugAbYqBgROjqNOTOXZ1CHL8ifYw2td7kK:xbVYOinLnN1HGf2Jb3gRhjMxYwIIK
Malware Config
Signatures
Files
-
f7f47bc3421b0a7d260d24c4742e7d6a2d8a2e79898997db88a5aac4f5ced136.exe windows x86
4d0bcb5702f4b819a92ffa95ea0e6082
Code Sign
36:12:22:96:c5:e3:38:a5:20:a1:d2:5f:4c:d7:09:54Certificate
IssuerCN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6dNot Before01-08-1996 00:00Not After01-01-2021 23:59SubjectCN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d4d:3a:c8:39:26:4b:33:a0:44:7f:ab:7c:f3:c1:ec:71Certificate
IssuerCN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=USNot Before12-11-2013 00:00Not After12-11-2014 23:59SubjectCN=Shenzhen Futian Yinghui Electronic Line,O=Shenzhen Futian Yinghui Electronic Line,L=Shenzhen,ST=Guangdong,C=CNExtended Key Usages
ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91Certificate
IssuerCN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6dNot Before17-11-2006 00:00Not After30-12-2020 23:59SubjectCN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=USKey Usages
KeyUsageCertSign
KeyUsageCRLSign
47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate
IssuerCN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=USNot Before08-02-2010 00:00Not After07-02-2020 23:59SubjectCN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=USExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
6a:fc:da:d6:d4:94:d2:9f:b5:f2:90:e2:fb:83:e7:40:0a:8e:dc:d7Signer
Actual PE Digest6a:fc:da:d6:d4:94:d2:9f:b5:f2:90:e2:fb:83:e7:40:0a:8e:dc:d7Digest Algorithmsha1PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=Shenzhen Futian Yinghui Electronic Line,O=Shenzhen Futian Yinghui Electronic Line,L=Shenzhen,ST=Guangdong,C=CN24-11-2022 14:54 Valid: false
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameA
GetModuleHandleA
GetTempPathA
DeleteFileA
LoadLibraryA
WaitForSingleObject
OpenProcess
GetExitCodeProcess
CreateProcessA
CloseHandle
CreateFileA
MoveFileA
SetFilePointer
VirtualFree
ReadFile
MoveFileExA
WriteFile
DeviceIoControl
SetUnhandledExceptionFilter
SetFileTime
FileTimeToSystemTime
FlushFileBuffers
GetFileTime
GetPrivateProfileStringA
GetTempFileNameA
GetProcAddress
GetLastError
SetCurrentDirectoryA
Sleep
ExpandEnvironmentStringsA
GetCurrentProcess
GetFileSize
SetEnvironmentVariableA
CompareStringW
HeapReAlloc
LoadLibraryW
SetErrorMode
ExitProcess
CreateRemoteThread
DuplicateHandle
CreateDirectoryA
SetEndOfFile
HeapFree
HeapAlloc
GetProcessHeap
FindClose
FileTimeToLocalFileTime
GetDriveTypeA
FindFirstFileExA
GetCommandLineA
HeapSetInformation
GetStartupInfoW
EncodePointer
DecodePointer
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
SetLastError
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
RtlUnwind
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
LCMapStringW
MultiByteToWideChar
DeleteCriticalSection
RaiseException
GetFileType
CreateFileW
SetStdHandle
SetHandleCount
GetStdHandle
GetFullPathNameA
GetFileInformationByHandle
PeekNamedPipe
GetCurrentDirectoryW
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSize
GetStringTypeW
WriteConsoleW
IsProcessorFeaturePresent
GetDriveTypeW
GetTimeZoneInformation
GetLocaleInfoA
user32
wsprintfA
advapi32
CryptGenRandom
CryptAcquireContextA
CryptReleaseContext
shell32
ShellExecuteA
ord680
psapi
GetProcessImageFileNameA
EnumProcesses
shlwapi
PathFileExistsA
Sections
.text Size: 60KB - Virtual size: 59KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 472KB - Virtual size: 472KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ