Static task
static1
Behavioral task
behavioral1
Sample
f5063055e8ae6e381c0e5f8079a5c02391d16899e623c6987ada318319239bcf.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
f5063055e8ae6e381c0e5f8079a5c02391d16899e623c6987ada318319239bcf.exe
Resource
win10v2004-20220812-en
General
-
Target
f5063055e8ae6e381c0e5f8079a5c02391d16899e623c6987ada318319239bcf
-
Size
1.4MB
-
MD5
79cc8c077f2a73b69b5d19dfa6b7c56a
-
SHA1
99a8ea4845033d4084458d986228a72984e5d4b5
-
SHA256
f5063055e8ae6e381c0e5f8079a5c02391d16899e623c6987ada318319239bcf
-
SHA512
03fda769a72a5b66a9452add9ee5ae8f0ab07c66e8b52bd5ddd64b6288855cec510b2970434d2ce40d7a0e7d23c59841123d78512d3612a91efb037a7db5de45
-
SSDEEP
24576:RdCptxR1W5xZIp5IkI6AhJ8PNhZMszhO0Q1y7dJ4SaMK+HdqvVQkf:nCptxRE7ZVkNAbStOvmdJjb9Hdohf
Malware Config
Signatures
Files
-
f5063055e8ae6e381c0e5f8079a5c02391d16899e623c6987ada318319239bcf.exe windows x86
32ce588131d544a6a161db018285a422
Code Sign
03:18:5a:c4:78:c5:6a:ca:fd:1c:f0:c4:3c:7f:35:8bCertificate
IssuerCN=DigiCert TLS RSA SHA256 2020 CA1,O=DigiCert Inc,C=USNot Before11/11/2022, 00:00Not After12/12/2023, 23:59SubjectCN=yelp.com,O=Yelp Inc.,L=San Francisco,ST=California,C=US7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate
IssuerCN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=USNot Before12/01/2016, 00:00Not After11/01/2031, 23:59SubjectCN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate
IssuerCN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=USNot Before23/12/2017, 00:00Not After22/03/2029, 23:59SubjectCN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
4d:ca:ff:a4:f6:74:68:80:3f:ce:c9:f7:b1:0d:38:fb:fa:b0:4b:06:cf:21:9a:38:f3:6c:26:2d:18:33:7d:64Signer
Actual PE Digest4d:ca:ff:a4:f6:74:68:80:3f:ce:c9:f7:b1:0d:38:fb:fa:b0:4b:06:cf:21:9a:38:f3:6c:26:2d:18:33:7d:64Digest Algorithmsha256PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=yelp.com,O=Yelp Inc.,L=San Francisco,ST=California,C=US21/12/2022, 14:44 Valid: false
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetFileSize
lstrlenA
TlsGetValue
HeapAlloc
GetCurrentProcess
GetEnvironmentStringsW
HeapFree
GetLogicalDrives
GetTickCount
GetProcessHeap
IsBadReadPtr
GetCommandLineA
Sleep
HeapDestroy
ReadFile
CreateFileW
GetACP
MultiByteToWideChar
lstrlenW
GetLastError
SetLastError
GetProcAddress
IsValidCodePage
LoadLibraryA
SetConsoleTitleW
GetModuleHandleA
GetCommandLineW
CloseHandle
DeleteFileW
GetThreadUILanguage
SetEndOfFile
WriteConsoleW
SetFilePointerEx
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetStringTypeW
LCMapStringEx
WideCharToMultiByte
HeapReAlloc
LoadLibraryW
OutputDebugStringW
FreeEnvironmentStringsW
GetTickCount64
GetSystemTimeAsFileTime
QueryPerformanceCounter
InitOnceExecuteOnce
GetFileType
GetSystemDefaultLangID
GetCurrentThreadId
EncodePointer
DecodePointer
InterlockedDecrement
ExitProcess
GetModuleHandleExW
AreFileApisANSI
RaiseException
RtlUnwind
IsDebuggerPresent
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
TerminateProcess
GetStartupInfoW
GetModuleHandleW
GetStdHandle
WriteFile
GetModuleFileNameW
LoadLibraryExW
InterlockedIncrement
GetOEMCP
GetCPInfo
HeapSize
ReadConsoleW
user32
OpenIcon
IsIconic
GetMessageExtraInfo
GetTopWindow
IsZoomed
GetLastActivePopup
GetWindowTextLengthA
wsprintfW
GetDoubleClickTime
GetForegroundWindow
MessageBoxA
GetDesktopWindow
GetActiveWindow
IsWindow
IsWow64Message
MessageBoxW
GetSystemMetrics
IsWindowVisible
GetDlgCtrlID
GetMessageTime
GetMessagePos
Sections
.text Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 3.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 40KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ