Behavioral task
behavioral1
Sample
d0e3c4d0642a1226a2c44d15801c2517cc8b7718557052b7f3422cf7cae36353.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
d0e3c4d0642a1226a2c44d15801c2517cc8b7718557052b7f3422cf7cae36353.exe
Resource
win10v2004-20220812-en
General
-
Target
d0e3c4d0642a1226a2c44d15801c2517cc8b7718557052b7f3422cf7cae36353
-
Size
69KB
-
MD5
08e277e0f8d46835447d5b5d24d04d30
-
SHA1
e790aaf92d07871a6b65a7960a05cd64c150368d
-
SHA256
d0e3c4d0642a1226a2c44d15801c2517cc8b7718557052b7f3422cf7cae36353
-
SHA512
6c0b4dd1a20b191a948b0951f588f0c82e2892d89d75dad689c15ca5e982ee5a86a865474387e0b51f71d9d84813137197100bf291b6c0eed159375f91ae0ea9
-
SSDEEP
1536:RzUnH4fixspmfB5yRzNQwM/Qm2vS0Phzqulg3tAwclygnQnouy8trA:RzUYKCpmMQwMR2S0PBqDtAPlypouttrA
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
d0e3c4d0642a1226a2c44d15801c2517cc8b7718557052b7f3422cf7cae36353.exe windows x86
Code Sign
32:25:fb:5a:95:d0:75:82:45:45:99:be:4e:85:fb:b1Certificate
IssuerCN=VeriSign Class 3 Code Signing 2009 CANot Before17/10/2009, 16:00Not After18/10/2012, 16:00SubjectCN=Games Software Helper Tools23:35:a9:ef:3a:6f:3d:64:b1:cf:8d:1f:62:ad:bd:a0Certificate
IssuerCN=VeriSign Class 3 Code Signing 2009 CANot Before30/09/1999, 16:00Not After16/07/2036, 16:00SubjectCN=VeriSign Class 3 Code Signing 2009 CA00:48:8e:1e:06:17:ce:c2:26:ce:0f:ca:f6:b4:d8:1d:aa:2e:f4:21Signer
Actual PE Digest00:48:8e:1e:06:17:ce:c2:26:ce:0f:ca:f6:b4:d8:1d:aa:2e:f4:21Digest Algorithmsha1PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=Games Software Helper Tools01/12/2022, 14:34 Valid: false
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 108KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 62KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE