Static task
static1
Behavioral task
behavioral1
Sample
13de76d9bd7b628a0b9e61190c37f28aa551a8b243db061a43a4ea12dfb1b475.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
13de76d9bd7b628a0b9e61190c37f28aa551a8b243db061a43a4ea12dfb1b475.exe
Resource
win10v2004-20221111-en
General
-
Target
8538827898.zip
-
Size
1.3MB
-
MD5
7515b5ba3a960c81f33018c8ecfd14e6
-
SHA1
f72012e5fa28569a7502a80810d2bf2f9c20b804
-
SHA256
7f60a0ec086f162315616492a6a44fc7ae16884bf60ce3f7385ef07f7b72a470
-
SHA512
5e8f84932c2cc36f46f0b7b3efce7ff48684332ea2361d3bd530b5dc47a47b0a3ebb6b6de1b8e4371db46fc294c0940cf8915feb60f6280636f2c2f5745b7a5b
-
SSDEEP
24576:fKFrJ7DQOVNV8b8pm4lFVWROAHs6EooxeShmEEQKjYYstKAnhttFpLg:fKH7DQOVNubKm0FVW/HdoxxmjQKjGIQy
Malware Config
Signatures
Files
-
8538827898.zip.zip
Password: infected
-
13de76d9bd7b628a0b9e61190c37f28aa551a8b243db061a43a4ea12dfb1b475.exe windows x86
d29a25ea03cbea7c6c52ef946b45416b
Code Sign
0c:36:47:35:37:df:ad:a0:ac:33:ff:d9:d1:bd:c5:a1Certificate
IssuerCN=DigiCert TLS RSA SHA256 2020 CA1,O=DigiCert Inc,C=USNot Before04/04/2022, 00:00Not After05/05/2023, 23:59SubjectCN=*.taleo.net,O=Oracle Corporation,L=Redwood City,ST=California,C=US7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate
IssuerCN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=USNot Before12/01/2016, 00:00Not After11/01/2031, 23:59SubjectCN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate
IssuerCN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=USNot Before23/12/2017, 00:00Not After22/03/2029, 23:59SubjectCN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
9a:cb:78:d4:fc:25:3c:20:9a:c5:95:55:f7:0e:8c:b8:b0:6c:ac:6d:d4:fd:55:5c:f2:dc:68:1e:49:ca:30:38Signer
Actual PE Digest9a:cb:78:d4:fc:25:3c:20:9a:c5:95:55:f7:0e:8c:b8:b0:6c:ac:6d:d4:fd:55:5c:f2:dc:68:1e:49:ca:30:38Digest Algorithmsha256PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=*.taleo.net,O=Oracle Corporation,L=Redwood City,ST=California,C=US28/11/2022, 16:49 Valid: false
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateMutexW
GetDefaultCommConfigW
HeapAlloc
InterlockedIncrement
InterlockedDecrement
HeapFree
GetTickCount
GetCurrentThread
GetProcessHeap
GetDllDirectoryW
SwitchToFiber
Sleep
HeapCreate
GetFileAttributesW
ExitProcess
GetModuleFileNameW
CreateFileW
GetFileSizeEx
GetStdHandle
GetLastError
SetLastError
ReleaseMutex
CloseHandle
HeapSize
SetEndOfFile
ReadFile
GetProcessIdOfThread
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
RtlUnwind
GetModuleHandleW
GetProcAddress
WriteFile
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThreadId
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
CreateFileA
LoadLibraryA
VirtualAlloc
HeapReAlloc
FlushFileBuffers
SetFilePointer
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
MultiByteToWideChar
SetStdHandle
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
user32
GetDC
GetForegroundWindow
GetActiveWindow
MessageBoxW
wsprintfW
gdi32
GetPixel
Sections
.text Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 154KB - Virtual size: 153KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ