Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7-20220812-en
General
-
Target
Activated_Setup_Use_2023_As_Passw0rd.rar
-
Size
2.4MB
-
MD5
4ecd4bb0dbf4bc9dc21e2282df87dade
-
SHA1
7a6a2ec5c0d592e9e58588b6bb2d32b680ecbba5
-
SHA256
7f9efa6ee743fc4d1c6767f2afa90e433a319bc56c4cbeca1cceed9eeedd9762
-
SHA512
7b41725e63e8765f5b6af1c7b60d8faa44e4a81d63bd6a03a54a610f8048063187717c8a8ac7c75fecee6da6565a645c39cbed2dec71097badd67c3d63b94bcb
-
SSDEEP
49152:eI7MJTEPO8MVJJKpNwy/jCYc47m1A/KSbH5qySnzk+N+qVgz:eDE2fHJKpNwL747F/tqyEIE+3z
Malware Config
Signatures
Files
-
Activated_Setup_Use_2023_As_Passw0rd.rar.rar
Password: 2023
-
Setup.exe.exe windows x86
Password: 2023
f34d5f2d4577ed6d9ceec516c1f5a744
Code Sign
19:3a:fc:44:d8:ab:3f:9a:47:55:2f:73:56:e9:2f:6fCertificate
IssuerCN=Samsung C32R509FHI LC39R501FHIXCINot Before06/01/2023, 17:44Not After07/01/2033, 17:44SubjectCN=Samsung C32R509FHI LC39R501FHIXCI90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before11/05/2022, 00:00Not After10/08/2033, 23:59SubjectCN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02/05/2019, 00:00Not After18/01/2038, 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
e6:57:0a:d2:99:c7:0e:da:31:26:5e:1c:04:98:4c:98:57:e9:6a:39:c4:b0:14:68:8b:fa:82:10:bf:5d:3c:9aSigner
Actual PE Digeste6:57:0a:d2:99:c7:0e:da:31:26:5e:1c:04:98:4c:98:57:e9:6a:39:c4:b0:14:68:8b:fa:82:10:bf:5d:3c:9aDigest Algorithmsha256PE Digest MatchesfalseSignature Validations
TrustedfalseVerification
Signing CertificateCN=Samsung C32R509FHI LC39R501FHIXCI15/12/2022, 13:55 Valid: false
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 142KB - Virtual size: 141KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
langs/Croatian.ini
-
langs/Danish.ini
-
langs/English.ini
-
langs/Finnish.ini
-
langs/Hebrew.ini
-
langs/Hungarian.ini.ps1
-
langs/Indonesian.ini
-
langs/Japanese.ini
-
langs/Kazakh.ini
-
langs/Korean.ini.ps1
-
langs/Kurdish.ini
-
langs/Norwegian.ini
-
langs/SimpChinese.ini
-
langs/Sinhala.ini
-
langs/Slovak.ini
-
langs/Swedish.ini
-
langs/Thai.ini
-
langs/TradChinese.ini
-
langs/Ukrainian.ini
-
langs/UyghurLatin.ini
-
langs/Uzbek.ini
-
langs/Vietnamese.ini