Static task
static1
Behavioral task
behavioral1
Sample
755bd75343367080981a20517ffd65a9ef95a3976ba3e7fc3bdef7849cd35f17.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
755bd75343367080981a20517ffd65a9ef95a3976ba3e7fc3bdef7849cd35f17.exe
Resource
win10v2004-20220812-en
General
-
Target
755bd75343367080981a20517ffd65a9ef95a3976ba3e7fc3bdef7849cd35f17
-
Size
209KB
-
MD5
901c4df73ca9717ccc75de7ca85c57ad
-
SHA1
8a2dc49c0fd8e03ecaeb6ddc17f57bcadce84d18
-
SHA256
755bd75343367080981a20517ffd65a9ef95a3976ba3e7fc3bdef7849cd35f17
-
SHA512
5822e34db1e04188d0c7b1f758aa5a18ec5bf567fa38cd13b15cfbb5cbe262ce6f935515ffdda0899b4ec36c6fada66ebdc7d6323d339c1130d27e06e9a6ad82
-
SSDEEP
6144:sTBk6WUjcaJ8mMRCE3aNWKee/vxpcrgNAy1q:cy6jjc88XRCE3aNWwbcraA7
Malware Config
Signatures
Files
-
755bd75343367080981a20517ffd65a9ef95a3976ba3e7fc3bdef7849cd35f17.exe windows x86
07cd32fe06d43febfbbba5706c9ac01e
Code Sign
01Certificate
IssuerCN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6dNot Before01-08-1996 00:00Not After31-12-2020 23:59SubjectCN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d0aCertificate
IssuerCN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6dNot Before06-08-2003 00:00Not After05-08-2013 23:59SubjectCN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZAExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before15-06-2007 00:00Not After14-06-2012 23:59SubjectCN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04-12-2003 00:00Not After03-12-2013 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
21:d9:1d:91:5f:64:fe:5a:ea:a1:6d:d9:b4:6f:06:ddCertificate
IssuerCN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZANot Before22-10-2008 00:00Not After23-11-2010 23:59SubjectCN=Qizhi Software (beijing) Co. Ltd,OU=SECURE APPLICATION DEVELOPMENT,O=Qizhi Software (beijing) Co. Ltd,L=Beijing,ST=Beijing,C=CNExtended Key Usages
ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
Signer
Actual PE DigestDigest AlgorithmPE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
_controlfp
_strlwr
_strnicmp
_itoa
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
??1type_info@@UAE@XZ
strstr
strncpy
_CxxThrowException
__CxxFrameHandler
strcmp
??3@YAXPAX@Z
memcpy
??2@YAPAXI@Z
memset
strchr
strncat
strcat
tolower
toupper
_ftol
srand
rand
strcpy
_except_handler3
strlen
_stricmp
kernel32
GetStartupInfoA
MultiByteToWideChar
GetLastError
CreateDirectoryA
GetFileAttributesA
lstrcpyA
lstrlenA
DeleteFileA
SetFileAttributesA
CloseHandle
Process32Next
GetCurrentProcessId
Process32First
CreateToolhelp32Snapshot
GetTickCount
lstrcatA
GetSystemDirectoryA
HeapFree
GetProcAddress
GetModuleHandleA
HeapAlloc
GetProcessHeap
ExitProcess
SetEnvironmentVariableA
GetWindowsDirectoryA
GetTempPathA
MoveFileA
SetFileTime
WideCharToMultiByte
SystemTimeToFileTime
SetFilePointer
WriteFile
CreateFileA
lstrcmpiA
GetModuleFileNameA
Sleep
WaitForSingleObject
CreateEventA
OpenEventA
SetUnhandledExceptionFilter
GetCommandLineA
LocalFileTimeToFileTime
user32
wsprintfA
advapi32
GetUserNameA
GetServiceKeyNameA
StartServiceA
ControlService
OpenSCManagerA
CreateServiceA
DeleteService
CloseServiceHandle
RegCreateKeyExA
RegSetValueExA
RegDeleteKeyA
RegDeleteValueA
RegQueryValueExA
RegEnumKeyExA
RegEnumValueA
RegOpenKeyExA
RegCloseKey
LookupAccountNameA
GetFileSecurityA
InitializeSecurityDescriptor
GetSecurityDescriptorDacl
GetAclInformation
GetLengthSid
InitializeAcl
GetAce
EqualSid
AddAce
AddAccessAllowedAce
SetSecurityDescriptorDacl
GetSecurityDescriptorControl
SetFileSecurityA
shlwapi
SHDeleteKeyA
netapi32
NetApiBufferFree
NetUserGetLocalGroups
Sections
.text Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 160KB - Virtual size: 161KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ