Static task
static1
Behavioral task
behavioral1
Sample
o35IyQKf1OWr.exe
Resource
win10-20220812-en
General
-
Target
o35IyQKf1OWr.exe
-
Size
1.2MB
-
MD5
0157de5a2bc0a4a3ee44ce3a604b5a08
-
SHA1
8728fd4dca74a8ae0a28d0e2fb99b2727bd1b278
-
SHA256
235c44be3c65568e1550596182f0fe3b1b3540c95b62e63a00e2a4853c561b2c
-
SHA512
4dacc34bf5215de1add50d7b7332b1eaa15c0074ceb8d9fc02bfca530910333090573b39b9f7635d312aaaf6e732436d779cef39b292b51ee4082f1e68b3786a
-
SSDEEP
24576:MqoHvJlD2PGnBVrXTnuePJmt909gfuUNeye4Mrs:M1H2iBZXxPcTCgfHpeJs
Malware Config
Signatures
Files
-
o35IyQKf1OWr.exe.exe windows x86
d29a25ea03cbea7c6c52ef946b45416b
Code Sign
0c:36:47:35:37:df:ad:a0:ac:33:ff:d9:d1:bd:c5:a1Certificate
IssuerCN=DigiCert TLS RSA SHA256 2020 CA1,O=DigiCert Inc,C=USNot Before04-04-2022 00:00Not After05-05-2023 23:59SubjectCN=*.taleo.net,O=Oracle Corporation,L=Redwood City,ST=California,C=US7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate
IssuerCN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=USNot Before12-01-2016 00:00Not After11-01-2031 23:59SubjectCN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate
IssuerCN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=USNot Before23-12-2017 00:00Not After22-03-2029 23:59SubjectCN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
20:0a:6c:57:50:d1:be:44:2f:f6:fa:d6:e7:c8:93:9b:9b:ec:ea:f2:e3:f4:1b:2d:0f:5b:d9:70:3b:2b:f1:a0Signer
Actual PE Digest20:0a:6c:57:50:d1:be:44:2f:f6:fa:d6:e7:c8:93:9b:9b:ec:ea:f2:e3:f4:1b:2d:0f:5b:d9:70:3b:2b:f1:a0Digest Algorithmsha256PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=*.taleo.net,O=Oracle Corporation,L=Redwood City,ST=California,C=US28-11-2022 16:33 Valid: false
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateMutexW
GetDefaultCommConfigW
HeapAlloc
InterlockedIncrement
InterlockedDecrement
HeapFree
GetTickCount
GetCurrentThread
GetProcessHeap
GetDllDirectoryW
SwitchToFiber
Sleep
HeapCreate
GetFileAttributesW
ExitProcess
GetModuleFileNameW
CreateFileW
GetFileSizeEx
GetStdHandle
GetLastError
SetLastError
ReleaseMutex
CloseHandle
HeapSize
SetEndOfFile
ReadFile
GetProcessIdOfThread
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
RtlUnwind
GetModuleHandleW
GetProcAddress
WriteFile
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThreadId
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
CreateFileA
LoadLibraryA
VirtualAlloc
HeapReAlloc
FlushFileBuffers
SetFilePointer
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
MultiByteToWideChar
SetStdHandle
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
user32
GetDC
GetForegroundWindow
GetActiveWindow
MessageBoxW
wsprintfW
gdi32
GetPixel
Sections
.text Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 155KB - Virtual size: 155KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ