Static task
static1
Behavioral task
behavioral1
Sample
Install.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Install.exe
Resource
win10v2004-20221111-en
General
-
Target
Install.exe.zip
-
Size
3.8MB
-
MD5
a4f3f2238d938a80092240b9d5b68036
-
SHA1
2eb80c6cd467ef479715c8d9aa2471e5dea59b88
-
SHA256
5b3e14a0086faf5df7f3d08e120a65a08a8fbed9b582bd9038c11989062c8123
-
SHA512
e627575881dabbfaabc000e3ef3caecc7358a6d1d2bbba8cf3d7cdfd64981a5cfc2ecb6144f4e83cd0ffc4206705b2f0c187bbeee80578581e5eb7df629f3b94
-
SSDEEP
98304:fsHqukEFdCv6FnhbL2PjeAq9DQ2X1t+fvN:+hjs6FnhX4zq9s2FYnN
Malware Config
Signatures
Files
-
Install.exe.zip.zip
-
Install.exe.exe windows x64
Code Sign
25:62:fe:2d:6c:04:af:86:4a:d9:75:1b:75:ed:e7:cbCertificate
IssuerCN=HDD Verbatim Digital EVO-II 5Tb HDWG460EZSTA N300 (4096rpm) 5036Mb 3.5 RtlNot Before22-01-2023 12:51Not After23-01-2033 12:51SubjectCN=HDD Verbatim Digital EVO-II 5Tb HDWG460EZSTA N300 (4096rpm) 5036Mb 3.5 Rtl90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before11-05-2022 00:00Not After10-08-2033 23:59SubjectCN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02-05-2019 00:00Not After18-01-2038 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
42:fb:70:b7:fe:23:de:ce:48:a8:db:7d:24:23:46:a7:9c:75:76:84:af:79:c5:34:23:0d:39:29:cf:32:28:b8Signer
Actual PE Digest42:fb:70:b7:fe:23:de:ce:48:a8:db:7d:24:23:46:a7:9c:75:76:84:af:79:c5:34:23:0d:39:29:cf:32:28:b8Digest Algorithmsha256PE Digest MatchesfalseSignature Validations
TrustedfalseVerification
Signing CertificateCN=HDD Verbatim Digital EVO-II 5Tb HDWG460EZSTA N300 (4096rpm) 5036Mb 3.5 Rtl20-01-2023 15:46 Valid: false
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 2.6MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 974KB - Virtual size: 973KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ