Behavioral task
behavioral1
Sample
1E90B6FC99A908420DE123418DEDED8D8EADF2114AC43.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
1E90B6FC99A908420DE123418DEDED8D8EADF2114AC43.exe
Resource
win10v2004-20220812-en
General
-
Target
1E90B6FC99A908420DE123418DEDED8D8EADF2114AC43.exe
-
Size
4.7MB
-
MD5
fb67481e2ae37b3f0304048d15e76ba6
-
SHA1
035c005e34504bd0228feaf4b54eea743894b7aa
-
SHA256
1e90b6fc99a908420de123418deded8d8eadf2114ac43ee1ec366681b5358c17
-
SHA512
1e70cb639cff93f597553736899037b42ca61cca6af7e61c5e662d14010cc7c5f49efd949a5e997ac58766c46689c72e404717ea6562c1a71fc74d947cbcf006
-
SSDEEP
98304:faBDlNcMRYwhDlXn7/IZZkwFiXjM65m2UjVE7TmJyxaaWESfmYR:fgqmYQDlLQZZkwqI26DJsapR
Malware Config
Signatures
-
Processes:
resource yara_rule sample vmprotect
Files
-
1E90B6FC99A908420DE123418DEDED8D8EADF2114AC43.exe.exe windows x86
f9644890a52aa13e3e994733d15fcb99
Code Sign
54:36:1f:0c:ed:37:d8:a2:4c:d1:1b:25:c2:e4:e8:9aCertificate
IssuerCN=Intel Celeron Skylake G3900 OEMNot Before13-11-2022 23:31Not After14-11-2032 23:31SubjectCN=Intel Celeron Skylake G3900 OEM90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before11-05-2022 00:00Not After10-08-2033 23:59SubjectCN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02-05-2019 00:00Not After18-01-2038 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
1b:b8:16:f5:20:da:16:8f:d8:5e:b0:f0:19:16:7f:cd:ca:28:1d:0b:13:50:ed:f1:bb:74:de:64:02:0e:3c:8cSigner
Actual PE Digest1b:b8:16:f5:20:da:16:8f:d8:5e:b0:f0:19:16:7f:cd:ca:28:1d:0b:13:50:ed:f1:bb:74:de:64:02:0e:3c:8cDigest Algorithmsha256PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=Intel Celeron Skylake G3900 OEM15-12-2022 14:00 Valid: false
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
InitializeCriticalSectionEx
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
CharNextA
advapi32
RegCloseKey
shell32
ShellExecuteA
ole32
CoCreateInstance
Sections
.text Size: - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 168KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 4.6MB - Virtual size: 4.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 76KB - Virtual size: 380KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ