Static task
static1
Behavioral task
behavioral1
Sample
faa09035b6b16ea16bc179fc9114406e343bb6ab86c1f9d686f0544ef5657c8c.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
faa09035b6b16ea16bc179fc9114406e343bb6ab86c1f9d686f0544ef5657c8c.exe
Resource
win10v2004-20220812-en
General
-
Target
faa09035b6b16ea16bc179fc9114406e343bb6ab86c1f9d686f0544ef5657c8c
-
Size
842KB
-
MD5
52da557b57d6f67478e4b9f9481a4d25
-
SHA1
5d2e2ae12b7228658e463592c2f693cb9017f6c7
-
SHA256
faa09035b6b16ea16bc179fc9114406e343bb6ab86c1f9d686f0544ef5657c8c
-
SHA512
dd78ed4705b6060c47597d4bead1e592af2557dc67ea65eb75a45ccf11682baee8e57153d876d4c8cb64d57d8fdcc250f382dd775136523cca7de1d10db45099
-
SSDEEP
24576:k/jsSEsgzS2shxWlQsxXTrbCJf5yIEx5j1M+YQb:kISEKs3xXfUMB5j8I
Malware Config
Signatures
Files
-
faa09035b6b16ea16bc179fc9114406e343bb6ab86c1f9d686f0544ef5657c8c.exe windows x86
43032a519669291ecf4231860a96d056
Code Sign
c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate
IssuerCN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft CorporationNot Before10/01/1997, 07:00Not After31/12/2020, 07:00SubjectCN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporationc1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate
IssuerCN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft CorporationNot Before10/01/1997, 07:00Not After31/12/2020, 07:00SubjectCN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation61:47:52:ba:00:00:00:00:00:04Certificate
IssuerCN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before16/09/2006, 01:53Not After16/09/2011, 02:03SubjectCN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
61:47:52:ba:00:00:00:00:00:04Certificate
IssuerCN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before16/09/2006, 01:53Not After16/09/2011, 02:03SubjectCN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate
IssuerCN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft CorporationNot Before16/09/2006, 01:04Not After15/09/2019, 07:00SubjectCN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
61:02:30:7e:00:00:00:00:00:06Certificate
IssuerCN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before10/03/2008, 21:57Not After10/06/2009, 22:07SubjectCN=Microsoft Windows Component Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
6a:0b:99:4f:c0:00:1b:ab:11:da:3a:a1:b6:df:ec:88Certificate
IssuerCN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft CorporationNot Before11/10/2005, 21:55Not After26/04/2010, 07:00SubjectCN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign
d2:f6:c8:21:bc:7b:15:8d:6c:b3:50:7b:89:7a:36:f2:00:7b:3f:45Signer
Actual PE Digestd2:f6:c8:21:bc:7b:15:8d:6c:b3:50:7b:89:7a:36:f2:00:7b:3f:45Digest Algorithmsha1PE Digest MatchesfalseSignature Validations
TrustedfalseVerification
Signing CertificateCN=Microsoft Windows Component Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US19/07/2008, 05:10 Valid: false
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetProcAddress
GetModuleHandleA
LoadLibraryA
RaiseException
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
mouse_event
GetKeyboardType
MessageBoxA
shell32
ShellExecuteA
advapi32
QueryServiceConfig2A
ReportEventA
RegQueryValueExA
StartServiceA
netapi32
Netbios
winmm
waveInUnprepareHeader
urlmon
URLDownloadToFileA
ws2_32
gethostname
mpr
WNetGetUserA
wsock32
WSACleanup
wininet
InternetReadFile
avicap32
capCreateCaptureWindowA
msvfw32
DrawDibDraw
gdi32
UnrealizeObject
comctl32
ImageList_SetIconSize
oleaut32
SafeArrayPtrOfIndex
SysFreeString
VariantChangeTypeEx
Exports
Exports
!69ճ��R_��b㭶.� U�-}yr <���ɼt�HO���p��TA��(N��Ġ�|p�B,�q��7 �G���4f��3�y�%C-���s*�X~m+�A�[����ӘN\2�Wp\���%$��\M3��l�c;�Ȗr)N�q���?�o��#M�� .>H�%��D�]Bi<G�+�:*.�N{ҟ���˕|�E�`rH�]��jU��9�D��Y,m!�X���MApb0��t��ԍ�:ȇ?�OG� �������@3$L�N��Q���b�/l���5�(~�W���0O�������z�XҨ��N���i�G�G�dX���2���g��}� ���^ƍA�-��λq}�S}|�木b�D�/����'��S'��"$�wU�$�<�;nC�%�w������2z�g�Ă #�U�C]���K}���[���IKKA�5���?��e����A'�<v�y��le���;�VK4��"����:��=�y�B �.����~z���op��c��DwU� �1B}~�D�p�����n������sp<6��Ï%6:�]|�U���)�L�����uy�<m������g�ն�����h��P,uA�aW|htv��������R�lV-`cܾ��?YpV �&�e*8��h��Fuɬ���9:FM�lL��S�Ev-+�(�N;O���V��; �(����������d]2g?��@��q{��)���B`XT���@>,�x8�R?�\d�H=%�>Q�/`�EEh�t��-v�~������(� 4�p��ʿ��&�������Qv��8����c.�^;>�VM/Y'8���Ԧ�=" [ �Jp:����.���K����J��E�;��HD�E}C�%q�d��/��)��uC'�R ���~Ԭk������z�l�7��V8�6�)��v���g�V�h�|(dP\D2���_�����Ff�@Ǹ�8W�j��;�Ԯ���_��� ���~?v���'}�n�6hoc=�x��'($�����1�����F�~��eb)Y�= 8-���c{�=�ʌi��q�5�U��Yج��8�K����CE��l2�,������I[���0�ؒf���=P)��f��t��%%�yA�I��,� �P[��c$( ��b��(CI1������>s�j��Af3M�`�U�����co���(��?�Ќ�^��C�ӅԥW�hC����� �@y.���Ǭ�e*l+.w������J՜�����;yŒ�R$fٷCHAȧ� ��<���Զ�f��<X�nsU��:��e:4i�±D�H���tA\�e�U.8��o��a����3o���+n�Ʈ\�0skcG1Na)��"O�7��ec�8�B!�f���b��]����XB�����g�p���7�jy�A��v�0� ��K����)���VW0dYBsyIG[v��sF��l�����,%{O�U2�Wm9��:��W��&~ �%�����a<��+����N�J�ʏi���pS8F�ȏ�&(�r���i��F����ق�b$Y ��)JQ>�A)�o�JK�8�*� ���g��یj��c`�QS���|@���c��3!<� �D|��D���� �Ү�9x) ����H�DGm���*��M�m�tI��������������@w4�~(�4zJ�eK|ۂ����R��s������%ӆ<��9u�ť�&"����Gڳ6���<l�M�n�x|"�VЙ�{D�uLF}���դ��2��FI��h�u��#5�(��a��������C�W�Q=c���E�ʌ�1�F,X�{� ��h$sC�i`��'��}��Mx*�[us��9��Pr��|Qa>����^�R��-�0�$��M��W:����/P�����Zm�?�m!�K���'F��5��C/@�������h����=*Y��}e���7��˝�����}���jzr��6�@�R���wq�aɔl��+��r�{�ɻ����9m��@aM�YY|�H�Z�KyJQ�,Rig���K}ls��Qy���KY�w@$�P�B'ˌv0�Wsmo����?c߁]&P� FX�m�)і�ox��^H i���vG��禆�;��>�P�����s�����9ƪ~}��e��g�{{�^��9(�F�uKj�J��.��%�^/;�+`4��V)���#~LӨr���7�3`T&�O�m�P��� w9��(����,r�������x���F��ť��)�S�B����e�92۪?!Gg88L�*а�;j��� �IYO3!T�'�Mu�yŲ��=�5�e�9$�y1�70���q������d8���cO�(W>e�7P��3�i�� Mk��kQ��M�\H���}�pkn��,I�Y.�X��ˢ�.���mgi����6�rN��%��-��@�X�/k>ҽ�v:W�#%�l��Q�6~ۘ�'��2��흻�1����X��ȢI���S�۳:a�I�My�c�e�t�]? �iN��n4H]����X�ɦ ��Co����2�z����w �U�����uL�A��ت��;�p+�(���PX\�e�t��8�o��ѩp ِJh�MAYk�<��*�`�1�`�`:����3�������8�*��-~�ѿ�� �Y�@����\s���Ix\�=O:O��M�f���L˦o?���� �fN�W�v��hR%n!�M����G��.�4L��v���b�tݐ�^ՙ >�Fmm��ms��P���K����b�H屋G$�o�)˲����ٕ�a��I�3`�f;��sW7��ME���N�����-�_�\b@��V)0���DU�w�P������:ߙ>"�#��A EE���f���k������0+��:v���T��?�Ț@� i� $>�C;��X�{�����@�n<A�3B�h0j9���Vk�3Nm��j?-W%���h.�O�+��M�7�[3�V�3����W��O����j��;f$��?k՝hE/!�ٳg��ō�6X#�r�<�0�P�isFʎP�(4���I6
Sections
Size: - Virtual size: 612KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 9KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.asfdsad Size: - Virtual size: 324KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
.vmp1 Size: 822KB - Virtual size: 821KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 140B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ