Static task
static1
Behavioral task
behavioral1
Sample
afb9ef50a26d48c0538a968133fb6ca268260bb5acb7c8689ffdab45cc2de146.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
afb9ef50a26d48c0538a968133fb6ca268260bb5acb7c8689ffdab45cc2de146.exe
Resource
win10v2004-20220812-en
General
-
Target
afb9ef50a26d48c0538a968133fb6ca268260bb5acb7c8689ffdab45cc2de146
-
Size
109KB
-
MD5
49b1e38a06f7f6f90cbec4c617532274
-
SHA1
1a63ed7581241b74874811684873f7865b0b2e88
-
SHA256
afb9ef50a26d48c0538a968133fb6ca268260bb5acb7c8689ffdab45cc2de146
-
SHA512
78906f589530c11e754e0dfe60664a3eeb099dafd75a0b9006f73bb5212e78f96b39e6f4cc02ca7289f9810c0f13ba603f891995e2976ed5b351cc4074f70297
-
SSDEEP
1536:9I14TU5N2nURJcK1+cCOirdSx7Ukvtd7zem73TI+6HA9jKHPKqVcDM:WqTWlJN+B3u7U29z0fu+K0cY
Malware Config
Signatures
Files
-
afb9ef50a26d48c0538a968133fb6ca268260bb5acb7c8689ffdab45cc2de146.exe windows x86
fbf1c10cda8c1801db04760b806387e2
Code Sign
4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3Certificate
IssuerOU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust NetworkNot Before12/05/1997, 00:00Not After07/01/2004, 23:59SubjectOU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9dCertificate
IssuerOU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust NetworkNot Before28/02/2001, 00:00Not After06/01/2004, 23:59SubjectCN=VeriSign Time Stamping Service,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)01,O=VeriSign\, Inc.Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate
IssuerCN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft CorporationNot Before10/01/1997, 07:00Not After31/12/2020, 07:00SubjectCN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation6a:0b:99:4f:c0:00:de:aa:11:d4:d8:40:9a:a8:be:e6Certificate
IssuerCN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft CorporationNot Before10/12/2000, 08:00Not After12/11/2005, 08:00SubjectCN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign
61:07:11:43:00:00:00:00:00:34Certificate
IssuerCN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before25/05/2002, 00:55Not After25/11/2003, 01:05SubjectCN=Microsoft Corporation,OU=Copyright (c) 2002 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
19:5a:1f:94:9f:7d:14:3f:30:a9:a8:e9:61:6a:40:15:99:cf:7c:7bSigner
Actual PE Digest19:5a:1f:94:9f:7d:14:3f:30:a9:a8:e9:61:6a:40:15:99:cf:7c:7bDigest Algorithmsha1PE Digest MatchesfalseSignature Validations
TrustedfalseVerification
Signing CertificateCN=Microsoft Corporation,OU=Copyright (c) 2002 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US01/12/2022, 14:34 Valid: false
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetCurrentThreadId
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
CharNextA
MessageBoxA
oleaut32
SysFreeString
advapi32
RegSetValueExA
Exports
Exports
A�._��4v��>[2o�` Q���p:�>u���<M�_l�zr��t��A' �&���_����Щ���ve�Ʀ�&"�o��^�.���2��N0.�LL�bv�ټP��ވR��4��s$�R`n�L�DW�iȌ�pe��%�v Ah���W徒ju�ݚw��#���m��l����7r��d���3�w+���gC�a!:ɤ �B����� �]b�O��4�}�Ը_(���!��f߉�X9�����qL���m����w�^~�s�f���k���E�/�=����4���=ޒ�]PP5|I�S�������x��<d�6���0F�&��-�v: �����Z�JL���rI�P3�yA?A�<Ar���s��uR�G�����0z��Y���/����ɀ�Z/ׅ(�(���S6�� z�SE.�y�f����I�[r�QqŚYr/%Nt�DذMUc��|���߰f����Bu3��C����*u��V���R�| ϥ�ߞn��"r�~��0��p���F�.Qؤ!#��=h�7ƨ�D���40��O�a1ʗ�u�'�E�AUO�/ĵ��z"#|�1�~)*A��p<b^�N��sk��O�vٚ����?5����f���L�^�\������� 梨|�L��q�/ZFP���|=�$M}�0`ȣm���G��**��H-�_t�A�Ԟ�����:~y�*z�_(@���v����g�/\�Ax���-W����O��������n��o�b���B'�4�L�4H�PRy&n�$���5W���:��� ��(�qw_�`8 *���eO Kr�<!'�I������_�`i���욐zx�~25p��[ݘ8$� ��-�d�qHT �[`%Q���*/�%�,��g撵��"�@I�L�f�m+�� �S�n��=���fїLU� �8 �Am�W��;��p�uC��y�Ώ��g��;�����A�x�}�9�X>l9ĶA�Gt[�B��}d���.Ȍ��tz�4��/��� f]��R~����(Ҩ�w3r����Y�lS��^�,��bC�2;�A�C[�[�_�*�;W���D���1l8���Q�<��0q�7���B�;L�;A˙ٱ^�C�"=̞��M��ږ����A�\e~#�4r�*#"I�#�2���A�F��ǧ�����*/Ҹ�_xG��$r��1�](�����g���=7�������E��g����w��&����)�yo�e��{�X*k�uڕ'�1���*$ڃb��l�a�x�|o��]�R~�^fC⊨��Y���~vh�s ��&ߑM(�[G_�p��\��j�;�0��8H G� �Ʊ�0&'s3Ӗ����IHKi�u��A�N��fuQ[՟�ͨ�7 L�Tv^����z�!c[�"Q��Y��9A�ȭ1i"��v9_��3|"�E��gx,�������-dȲCU�I�W%�*����}�m����z�ylX˪��۵�r/$I��Ў�4���G������c|#�q�А4-V���m�킙�|�3vi@Yի��k�PIq����)���%rIz߁Hc�e��(�O+S7g���~=�S�S#�����_���}eD������Q� I��)���ΐ<,��N�A&�3��&�ߤ)[����{��rA;U���#N7��7����=�C������3^�AE-%���Hq>��;D����MZ�a�X8s��z�v�����r�(��6&~��y��Ѓ�P��%���T��&�����[y0�� ����.;���@�F3�����P�"��K�R٫�9!$����͟t�xp�l�|�m��.r��#���j`z��5��D����F����p�*S8$g\O�'p�[,o�aoC�;�F�Ct�/�v��F�.n���n��s+,1/��ኵ1,@W�֍,�H``��&+�[E���G�|&�y��������2����K��Pˎ��#\o7Xd�H�O����w�����}���`�Ц3���p���8U߈c�������%x�<��®�ߤ�rN�d��w��lu$qU�.I}�q<n]Ώwo�mE�W(P�?���� q�R�⪺��#b���9U������=w3��� J'��x��O�"����hF}2[�jވu��u��<�|ӭ�b����Q�M�h�'c�Ќ��F���#� �r7�:쮊���%LbP,*��u]��ؒ�.�����т�����9�+YS��<��9p���V<�?5w����c�h�u���釴����|M�C �Vs;��7H,�l#�)��l�Aޅ��s�S�c����(lh�Y��I�Lߚ�j�� �7S�l��k�:t�\ �D�$�6�NVf+��i���U�h�*s�>hR��1j�j���4���K#�"FS��5���H�"��,[h��/t\q��sS��99�� *(�Ҽ��#�E ����"��`�� �m�27�鮦���Q��K��Dס��2��Ms�~8Fvvy��~��u�L�_q�fQ8�%O����ϓ�+�|���2_�cVn�7�g��N_#c��v����/�`�����X�Y�6`��;��P\��E`�-K� ��4!�F�B�R�-��|��p��(�2�L<i�d @�����V�{��L_���Õ�i_��{ �4����m�+�"��o�4��<��^�zqZAn/�;�]��o��{y��S�9�H�v~�|<��uE�l�Wd:����^l��h5Gg{�0�>I(+�Ts��w�����KvY�ḭ����U�]�W`^pX> 4�ܭgG�q�S��b���(�n�y�6VF��*!k'��.x�a�}�"����ع�,��쁧&��)�䤿@�H����V��ȼ�%"��u}���������B�|��b������~pj��� h��������7���3^G鯛��G���kMw�*��и����P�0�������<�;o�7[�SN~���N���ݕY��,Uc��µ��,������V#�4���8=�6��rr���Vn��[F���hÇ�ێL�b�?Mw�?��,�rF1��
Sections
CODE Size: - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 2KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.www0 Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.www1 Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.www2 Size: - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.www3 Size: 98KB - Virtual size: 97KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ