Static task
static1
Behavioral task
behavioral1
Sample
ea42e0e4cb0f2fce99e5fab1307039c1425b60f33479325c3f3dc0ac71d8e77b.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
ea42e0e4cb0f2fce99e5fab1307039c1425b60f33479325c3f3dc0ac71d8e77b.exe
Resource
win10v2004-20220812-en
General
-
Target
ea42e0e4cb0f2fce99e5fab1307039c1425b60f33479325c3f3dc0ac71d8e77b
-
Size
986KB
-
MD5
7fbfa0d896f1297f6ac4a2c30faa1e13
-
SHA1
b20f28b73f9c2f34d9e2611b659ecc8730bf9d87
-
SHA256
ea42e0e4cb0f2fce99e5fab1307039c1425b60f33479325c3f3dc0ac71d8e77b
-
SHA512
22ecc9910e66d5a7c6575b921e5f9510a655c34f58b6fa1dc79ef6da2c2ff0a956ec01c11b3ad3966fb19e857510b5fcbcff1daa71cbafe2aa2a3f9bd912f7de
-
SSDEEP
24576:Lt/Z9arRbSnCS/ZmExYaEsAGSTU9twGTdK8kUu1hLMlV:NCFbSCSIEiLsA+92udK8bKYV
Malware Config
Signatures
Files
-
ea42e0e4cb0f2fce99e5fab1307039c1425b60f33479325c3f3dc0ac71d8e77b.exe windows x86
33ee1df416e289ef808384d7e5e07d4e
Code Sign
70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bfCertificate
IssuerOU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=USNot Before29-01-1996 00:00Not After01-08-2028 23:59SubjectOU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US68:2b:2c:3c:d8:59:f9:61:d9:21:22:92:a7:2c:20:8bCertificate
IssuerCN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=USNot Before06-10-2009 00:00Not After10-10-2012 23:59SubjectCN=LogMeIn\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=LogMeIn\, Inc.,ST=Massachusetts,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate
IssuerOU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=USNot Before21-05-2009 00:00Not After20-05-2019 23:59SubjectCN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
0e:79:38:68:59:1d:78:80:d8:fa:04:2a:2a:af:70:3e:b5:1c:4e:46Signer
Actual PE Digest0e:79:38:68:59:1d:78:80:d8:fa:04:2a:2a:af:70:3e:b5:1c:4e:46Digest Algorithmsha1PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=LogMeIn\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=LogMeIn\, Inc.,ST=Massachusetts,C=US01-12-2022 14:34 Valid: false
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetWindowsDirectoryA
Sleep
CreateDirectoryA
SetCurrentDirectoryA
FindFirstFileA
SetLastError
GetProcAddress
RemoveDirectoryA
GetTempFileNameA
FindClose
FindNextFileA
GetModuleHandleA
GetTempPathA
DeleteFileA
lstrcmpA
lstrlenA
lstrcpynA
LockResource
CloseHandle
lstrcpyA
CreateFileA
FindResourceA
SetFilePointer
FreeResource
LoadResource
WaitForSingleObject
FormatMessageA
WriteFile
SizeofResource
GetFileAttributesA
GetExitCodeProcess
CreateProcessA
lstrcatA
GetLastError
CopyFileA
HeapAlloc
HeapFree
GetProcessHeap
GetStdHandle
ExitProcess
GetStartupInfoA
GetCommandLineA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
RtlUnwind
user32
wvsprintfA
wsprintfA
MessageBoxA
Sections
.text Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 932B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 969KB - Virtual size: 969KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ