Static task
static1
Behavioral task
behavioral1
Sample
ba32c4c658139f2d6eeb2d6738b94a3fb00348193b6fbb7d0c6607ecf98a6026.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ba32c4c658139f2d6eeb2d6738b94a3fb00348193b6fbb7d0c6607ecf98a6026.exe
Resource
win10v2004-20220901-en
General
-
Target
ba32c4c658139f2d6eeb2d6738b94a3fb00348193b6fbb7d0c6607ecf98a6026
-
Size
264KB
-
MD5
385bf84d7d14e4bb073ced9f15a7d38c
-
SHA1
7d326eecef966e104365cbe5f331ec46d70e9da5
-
SHA256
ba32c4c658139f2d6eeb2d6738b94a3fb00348193b6fbb7d0c6607ecf98a6026
-
SHA512
ccdd1e7cc0e60d8def54c400d89343b4920661b5576d9f770f63bb9cf2302002d155a5589eec51cfaa15bf6b2fbb5b04e4ac430255da6d50892da00af1b82f60
-
SSDEEP
6144:OMnEC395ZK8Ek3RdS4+xsofQKIOCuInQ0YMZxxN30L:OrCvZho4+DIFnQ0RU
Malware Config
Signatures
Files
-
ba32c4c658139f2d6eeb2d6738b94a3fb00348193b6fbb7d0c6607ecf98a6026.exe windows x86
29fd5ddf7bd9ccdca7440eb944aebe93
Code Sign
01Certificate
IssuerCN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6dNot Before01/08/1996, 00:00Not After31/12/2020, 23:59SubjectCN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d0aCertificate
IssuerCN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6dNot Before06/08/2003, 00:00Not After05/08/2013, 23:59SubjectCN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZAExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
01:d1:51:d4:6a:31:f4:d1:ff:4e:3a:0a:8a:ec:82:0fCertificate
IssuerCN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZANot Before16/06/2008, 00:00Not After30/05/2010, 23:59SubjectCN=Foxit Software Company,OU=SECURE APPLICATION DEVELOPMENT,O=Foxit Software Company,L=San Jose,ST=California,C=USExtended Key Usages
ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
46:6f:96:c1:5e:0b:0b:96:a6:e9:f7:65:bd:19:d4:7f:c5:dd:51:25Signer
Actual PE Digest46:6f:96:c1:5e:0b:0b:96:a6:e9:f7:65:bd:19:d4:7f:c5:dd:51:25Digest Algorithmsha1PE Digest MatchesfalseSignature Validations
TrustedfalseVerification
Signing CertificateCN=Foxit Software Company,OU=SECURE APPLICATION DEVELOPMENT,O=Foxit Software Company,L=San Jose,ST=California,C=US01/12/2022, 14:34 Valid: false
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcatW
SetEvent
FileTimeToSystemTime
GetEnvironmentVariableA
lstrlenA
OpenMutexW
TlsAlloc
GlobalGetAtomNameA
GetCalendarInfoA
CreateDirectoryA
lstrcmpW
IsBadReadPtr
LoadLibraryA
GetTempFileNameW
OpenSemaphoreW
CopyFileExA
FindAtomA
MoveFileA
GetProcAddress
CreatePipe
SetComputerNameW
EnumTimeFormatsA
GetWindowsDirectoryA
RaiseException
GetDiskFreeSpaceW
GetSystemDirectoryA
SetUnhandledExceptionFilter
lstrcmpA
GetVersionExW
DeleteAtom
lstrcat
EnumDateFormatsA
DuplicateHandle
EnumCalendarInfoA
GetACP
CompareFileTime
lstrlen
IsBadStringPtrA
SetErrorMode
GetExitCodeThread
lstrcpynA
GetUserDefaultLangID
FileTimeToDosDateTime
GetModuleHandleA
GetTimeFormatW
SystemTimeToFileTime
lstrcpynW
ConnectNamedPipe
lstrcatA
ExpandEnvironmentStringsW
GetUserDefaultLCID
GetCurrentDirectoryW
LoadResource
WaitForMultipleObjects
GetCurrentDirectoryA
GetThreadPriority
GetCPInfo
ReadDirectoryChangesW
InitializeCriticalSection
CopyFileExW
GetExpandedNameA
GetStartupInfoW
GetVersionExA
GetAtomNameA
GetTickCount
SearchPathA
EnumCalendarInfoW
GetWindowsDirectoryW
EnumDateFormatsW
FreeLibrary
LoadLibraryA
SearchPathW
OpenEventW
GetFileAttributesW
SetLocaleInfoA
LoadLibraryW
CreateNamedPipeA
FatalAppExitW
GlobalFindAtomW
OpenWaitableTimerA
lstrcmpiW
GetLongPathNameW
GetSystemDirectoryW
GlobalFindAtomA
GetLogicalDrives
SetLocaleInfoW
WinExec
GetLogicalDriveStringsA
GetEnvironmentStringsA
GetMailslotInfo
LocalAlloc
QueryPerformanceFrequency
GetEnvironmentVariableW
GetSystemInfo
GetLogicalDriveStringsW
GetOEMCP
user32
GetClassInfoA
mouse_event
wvsprintfW
GetDCEx
EnableWindow
CreateDesktopW
EnableMenuItem
LoadBitmapA
WaitMessage
GetMenuStringA
GetCapture
LoadIconW
keybd_event
wvsprintfA
LoadIconA
CreateDialogParamA
RegisterClassA
SetDlgItemTextA
GetIconInfo
GetMenuStringW
InsertMenuItemW
CharPrevA
RegisterWindowMessageW
SetWindowTextW
TrackPopupMenuEx
GetMenuItemInfoA
ShowCaret
SendDlgItemMessageA
LoadCursorW
GetMenuItemID
OpenClipboard
GetSysColorBrush
DestroyCursor
RemoveMenu
wsprintfW
TrackPopupMenu
LoadBitmapW
UnregisterClassW
OffsetRect
SetCursor
FindWindowA
EndMenu
wsprintfA
DialogBoxIndirectParamA
RegisterClassExA
GetKeyState
CharNextA
LoadMenuW
SetParent
RegisterClassExW
AdjustWindowRect
SendDlgItemMessageW
GetMessageW
ActivateKeyboardLayout
GetClassInfoExA
CheckMenuItem
DialogBoxParamA
PeekMessageW
MoveWindow
IsMenu
GetMenuItemRect
IsIconic
CopyRect
InvalidateRect
GetMessageA
GetActiveWindow
SetFocus
LoadMenuIndirectA
SetDlgItemTextW
LoadMenuA
WinHelpW
FindWindowW
GetDlgItemTextW
GetMenuInfo
WaitForInputIdle
SetCapture
DefWindowProcA
LoadMenuIndirectW
SetTimer
LoadCursorA
IsWindow
DialogBoxIndirectParamW
MessageBoxIndirectW
GetMenuState
AppendMenuA
CreateDialogParamW
CharPrevW
CreateAcceleratorTableA
PeekMessageA
GetCaretPos
gdi32
CreateICA
RemoveFontResourceA
CreateFontIndirectW
AddFontResourceW
CreatePen
GetEnhMetaFilePixelFormat
CreateMetaFileA
CreateBitmap
RemoveFontResourceExA
RemoveFontResourceExW
SetEnhMetaFileBits
SetMetaFileBitsEx
GetStockObject
CreateColorSpaceA
GetTextExtentPointA
GdiGetBatchLimit
CreateFontIndirectA
CreateICW
CreateDIBSection
CreateCompatibleDC
CreateHatchBrush
GetRasterizerCaps
RemoveFontResourceW
CreatePolygonRgn
GetEnhMetaFileW
AddFontResourceA
CreatePolyPolygonRgn
CreateScalableFontResourceW
CreateFontW
GetEnhMetaFileA
SetWinMetaFileBits
CreateFontIndirectExW
CreateFontIndirectExA
UpdateICMRegKeyA
CreateRectRgn
GetTextExtentPointW
CreateMetaFileW
StretchDIBits
ExtCreateRegion
advapi32
ChangeServiceConfig2A
ConvertStringSecurityDescriptorToSecurityDescriptorW
SystemFunction041
LsaOpenAccount
setupapi
SetupQueryFileLogW
CM_Get_Device_ID_List_ExW
SetupDiGetClassDevsExW
SetupInstallFileW
CM_Get_Class_Key_Name_ExW
CM_Query_Arbitrator_Free_Data
ws2_32
send
WSASendTo
WSACloseEvent
getprotobynumber
getsockname
WSASend
htons
WSADuplicateSocketA
getpeername
WSARecvDisconnect
WSAEnumProtocolsW
WSACleanup
winmm
auxGetDevCapsA
DefDriverProc
midiInAddBuffer
midiInClose
midiInOpen
OpenDriver
midiInGetDevCapsW
wod32Message
timeSetEvent
cryptui
CryptUIDlgViewContext
CryptUIDlgSelectCA
oledlg
OleUIAddVerbMenuA
OleUIAddVerbMenuW
OleUIEditLinksA
Sections
.text Size: 13KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.eRHnl Size: 112KB - Virtual size: 126KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 7KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.boNAmD Size: 111KB - Virtual size: 180KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 311KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ