Static task
static1
Behavioral task
behavioral1
Sample
189e395afb4efe7bc8e300b644c1b290.exe
Resource
win7-20220812-en
General
-
Target
189e395afb4efe7bc8e300b644c1b290
-
Size
1.8MB
-
MD5
189e395afb4efe7bc8e300b644c1b290
-
SHA1
eabb53d1508bc5855360b387beb91429eff26f60
-
SHA256
b1852de0ce746f19baffdcb3a694b3a65a5dc813e2dfc0046da9474401f1ecbb
-
SHA512
90ae2566ca1b63840c9a088b754c7097e823a4c24ea7436948c2566d052031f7f18d9666e4e150eed2e09b76df14b41c1e6fd1975ee0dd89baca5602c72b0141
-
SSDEEP
49152:rOf7VkgZ41jwavGHKtNq8zE6AIQwX+LwULebD/M:rOfBx41PvrtNlAchOLIM
Malware Config
Signatures
Files
-
189e395afb4efe7bc8e300b644c1b290.exe windows x86
ac98dcb11dcbe3a24212098d21ff04d2
Code Sign
05:2a:5d:8b:4b:46:46:91:50:db:6b:c8:be:a4:86:33Certificate
IssuerCN=DigiCert SHA2 Secure Server CA,O=DigiCert Inc,C=USNot Before25-07-2022 00:00Not After18-08-2023 23:59SubjectCN=www.origin.com,O=Electronic Arts\, Inc.,L=Redwood City,ST=California,C=US7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate
IssuerCN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=USNot Before12-01-2016 00:00Not After11-01-2031 23:59SubjectCN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate
IssuerCN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=USNot Before23-12-2017 00:00Not After22-03-2029 23:59SubjectCN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
63:e7:c9:91:54:1d:93:51:88:ed:c9:6e:d5:43:1c:19:67:32:00:5e:01:26:7c:cf:2f:ba:c9:52:82:98:34:bfSigner
Actual PE Digest63:e7:c9:91:54:1d:93:51:88:ed:c9:6e:d5:43:1c:19:67:32:00:5e:01:26:7c:cf:2f:ba:c9:52:82:98:34:bfDigest Algorithmsha256PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=www.origin.com,O=Electronic Arts\, Inc.,L=Redwood City,ST=California,C=US13-10-2022 14:53 Valid: false
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
AcquireSRWLockShared
CloseHandle
LoadResource
SetWaitableTimer
MulDiv
SetEvent
CreateWaitableTimerW
GenerateConsoleCtrlEvent
GetConsoleWindow
GetConsoleAliasesA
GetHandleInformation
GetCommandLineW
GetDllDirectoryA
ResetWriteWatch
SetCommBreak
ClearCommError
FreeLibrary
EnumResourceNamesA
GetConsoleCP
GetFileSizeEx
ExitProcess
LoadLibraryW
SuspendThread
GetCurrentThread
GetThreadLocale
GetStringTypeW
GetWindowsDirectoryW
HeapCreate
GetSystemInfo
SetStdHandle
SetFilePointer
FlushFileBuffers
GetShortPathNameW
GetProcAddress
GetModuleHandleW
SetConsoleCP
LocalAlloc
HeapSize
LoadLibraryA
RaiseException
GetCommandLineA
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
GetLastError
Sleep
MultiByteToWideChar
ReadConsoleInputA
ReadConsoleInputW
SetConsoleMode
GetConsoleMode
WideCharToMultiByte
HeapFree
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
GetModuleHandleA
WriteFile
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
LCMapStringW
GetStringTypeA
GetLocaleInfoA
HeapAlloc
HeapReAlloc
CreateFileA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
VirtualAlloc
InitializeCriticalSectionAndSpinCount
RtlUnwind
ReadFile
user32
GetClipboardOwner
GetDlgItemTextW
LoadMenuA
MessageBoxW
SetScrollInfo
gdi32
GetFontLanguageInfo
GetDIBColorTable
comdlg32
PrintDlgA
ole32
CoRevertToSelf
OleBuildVersion
oleaut32
SysAllocString
SysFreeString
Sections
.text Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ