Static task
static1
Behavioral task
behavioral1
Sample
New order RS302-2023.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
New order RS302-2023.exe
Resource
win10v2004-20221111-en
General
-
Target
New order RS302-2023.exe
-
Size
1.5MB
-
MD5
79f29087b398759dea999db7057989c4
-
SHA1
246f73151b02a4c27285aa7ff3ce4bcb3f63fe0d
-
SHA256
1e82ed7a9d804175a7b412ac27314dbdf2e2c3453aca9954a12a30a521f47a8d
-
SHA512
c0606b2afd5e3d17a22a573bcd934e59b8b39bf2c3f7746fc4bef64167dd2691aad0cffcf709194c92be29db718cc38a7b771716d0660af5b7fbe3d9dc584024
-
SSDEEP
24576:ATEJn2l0Sq9c8CsQxUau+Eiu4Vk3XS4uIgByzgeGYKGb4BXy/A4H8tVytC:AE2l0e8CsQxa6v4TN0s4BXyxHsVy
Malware Config
Signatures
Files
-
New order RS302-2023.exe.exe windows x86
396c902890b802c5ec6bae321a9a9c71
Code Sign
58:51:70:21:88:2b:96:d7:76:7d:ca:2eCertificate
IssuerCN=GlobalSign RSA OV SSL CA 2018,O=GlobalSign nv-sa,C=BENot Before30-09-2022 01:51Not After01-11-2023 01:51SubjectCN=cars.com,O=Cars.com\, LLC,L=Chicago,ST=Illinois,C=US7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate
IssuerCN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=USNot Before12-01-2016 00:00Not After11-01-2031 23:59SubjectCN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate
IssuerCN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=USNot Before23-12-2017 00:00Not After22-03-2029 23:59SubjectCN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
da:b8:71:d4:37:55:17:2a:e6:cd:2f:62:12:b1:b1:04:b1:d0:ca:56:75:8a:63:58:6b:c7:44:46:41:02:70:0aSigner
Actual PE Digestda:b8:71:d4:37:55:17:2a:e6:cd:2f:62:12:b1:b1:04:b1:d0:ca:56:75:8a:63:58:6b:c7:44:46:41:02:70:0aDigest Algorithmsha256PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=cars.com,O=Cars.com\, LLC,L=Chicago,ST=Illinois,C=US13-02-2023 06:24 Valid: false
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GlobalAlloc
Sleep
Beep
GetModuleFileNameW
EnumSystemLocalesA
GetLastError
SetLastError
GetProcAddress
LoadLibraryA
GetCommandLineA
IsDebuggerPresent
IsProcessorFeaturePresent
InterlockedIncrement
InterlockedDecrement
GetCurrentThreadId
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
GetStdHandle
WriteFile
GetProcessHeap
GetFileType
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InitOnceExecuteOnce
GetStartupInfoW
GetModuleFileNameA
HeapValidate
GetSystemInfo
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount64
GetEnvironmentStringsW
FreeEnvironmentStringsW
WideCharToMultiByte
UnhandledExceptionFilter
SetUnhandledExceptionFilter
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetCurrentProcess
TerminateProcess
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
LoadLibraryExW
OutputDebugStringW
WaitForSingleObjectEx
CreateThread
LoadLibraryW
RtlUnwind
HeapFree
HeapReAlloc
HeapSize
HeapQueryInformation
HeapAlloc
GetStringTypeW
OutputDebugStringA
WriteConsoleW
LCMapStringEx
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
RaiseException
SetStdHandle
CloseHandle
CreateFileW
Sections
.text Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 30KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ