Behavioral task
behavioral1
Sample
b1ae6f0230fdbc46c99c0c8893f30cacbeac02b616fe50e58c29465fea4a11db.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
b1ae6f0230fdbc46c99c0c8893f30cacbeac02b616fe50e58c29465fea4a11db.exe
Resource
win10v2004-20220812-en
General
-
Target
b1ae6f0230fdbc46c99c0c8893f30cacbeac02b616fe50e58c29465fea4a11db
-
Size
50KB
-
MD5
51e13072c5e69e671fbf5abe06dcdd49
-
SHA1
0daf2ff53c9cdc502ff48563a7e242ff488bee47
-
SHA256
b1ae6f0230fdbc46c99c0c8893f30cacbeac02b616fe50e58c29465fea4a11db
-
SHA512
358d6dc3743d76a3cad26c3382ff54c347fade059f1e7898229c28e823599832aa20e51b257f1a982f11445a96445bd3b1ef587ecf2247ea5e015f94ea4c9258
-
SSDEEP
768:tscCv3YZRrk+igxXrbarQcREnbcuyD7Uhq9UHxHMzDDXyV0r:tscCvIZFkqxXrbwEnouy8hq9UKs0r
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
b1ae6f0230fdbc46c99c0c8893f30cacbeac02b616fe50e58c29465fea4a11db.exe windows x86
Code Sign
04:dc:f3:96:82:74:5e:82:49:f7:35:63:e9:8b:6e:f0Certificate
IssuerCN=Root AgencyNot Before18/12/2013, 09:20Not After31/12/2039, 23:59SubjectCN=万维网漏洞联盟中心,O=www.wwwbug.com,1.2.840.113549.1.9.1=#0c12777777406c69646f6e6766656e672e636f6d25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4cCertificate
IssuerCN=Certification Authority of WoSign,O=WoSign CA Limited,C=CNNot Before08/08/2009, 01:00Not After08/08/2024, 01:00SubjectCN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CNExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
9b:29:ea:49:ae:42:39:30:d7:eb:13:09:cf:55:ad:37:cf:97:fd:27Signer
Actual PE Digest9b:29:ea:49:ae:42:39:30:d7:eb:13:09:cf:55:ad:37:cf:97:fd:27Digest Algorithmsha1PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=万维网漏洞联盟中心,O=www.wwwbug.com,1.2.840.113549.1.9.1=#0c12777777406c69646f6e6766656e672e636f6d03/08/2014, 04:18 Valid: false
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 64KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 27KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE