FileActivityWatch[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

FileActivityWatch.exe
Size

141KB
MD5

f25ad53dd01cbd35bb090b12392ae5f6
SHA1

34ae5dc3e6cff784dd0c3f3ad441c40df20dbb2d
SHA256

d2ba02aae7518e185ac8c38beeb303ca448810ecd21e1d546532f621de6669b6
SHA512

69197eedf1b1b9e35b04b800addd4f84256d5e4fc8849ae5111efedcad3b49dea1f0241b44d30e1330ce47b162839c1da08957b30225e5e9042817146f952f92
SSDEEP

3072:4u+X+N81GDz6oUGOBzkfbw5UOpVwouIhQkzI0Luk7wsFmyHn6nIDq:4K6Hd1KbwGOG0LT6Yq

Score

10^/10

Malware Config

Signatures

Nirsoft 1 IoCs

resource	yara_rule
sample	Nirsoft

Files

FileActivityWatch.exe
.exe windows x64

0383c61a5278f09ef37147c967080c61

Code Sign

f7:a0:a7:30:c8:7d:94:cd:83:02:e3:ea:7f:66:1b:b7
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/09/2019, 00:00

Not After

09/09/2023, 23:59

Subject

CN=Nir Sofer,O=Nir Sofer,POSTALCODE=7135117,STREET=Dakar 21\, Unit 82,L=Lod,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23/10/2020, 00:00

Not After

22/01/2032, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5f:fd:3c:c6:9a:7c:64:83:9d:1a:1b:89:ae:09:d8:e5:a7:4b:7f:b4:c6:7f:13:7a:20:0e:14:aa:85:9a:99:37
Signer

Actual PE Digest

5f:fd:3c:c6:9a:7c:64:83:9d:1a:1b:89:ae:09:d8:e5:a7:4b:7f:b4:c6:7f:13:7a:20:0e:14:aa:85:9a:99:37

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Nir Sofer,O=Nir Sofer,POSTALCODE=7135117,STREET=Dakar 21\, Unit 82,L=Lod,C=IL

07/02/2023, 20:47
Valid: true

Chain 1

CN=Nir Sofer,O=Nir Sofer,POSTALCODE=7135117,STREET=Dakar 21\, Unit 82,L=Lod,C=IL

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

__wgetmainargs
_wcmdln
exit
_cexit
_exit
_c_exit
_XcptFilter
__C_specific_handler
_onexit
_initterm
_msize
calloc
realloc
_wcslwr
strlen
qsort
_itow
free
modf
wcsrchr
__setusermatherr
_commode
_fmode
__set_app_type
__dllonexit
wcstoul
towupper
wcscmp
_memicmp
malloc
??2@YAPEAX_K@Z
??3@YAXPEAX@Z
memcpy
_wcsnicmp
_purecall
_wtoi
memcmp
wcslen
_ultow
_wcsicmp
wcschr
wcscpy
memset
wcscat
_snwprintf
wcsncat

comctl32

ord17
CreateToolbarEx
CreateStatusWindowW
ImageList_Add
ImageList_Create
ImageList_AddMasked
ImageList_SetImageCount

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

kernel32

ExitProcess
Process32FirstW
ReadProcessMemory
SetErrorMode
Sleep
ExpandEnvironmentStringsW
DeleteFileW
Process32NextW
CreateToolhelp32Snapshot
OpenProcess
EnumResourceTypesW
CreateThread
GetStartupInfoW
GetLogicalDrives
GlobalFree
GetStdHandle
GetPrivateProfileStringW
GetPrivateProfileIntW
FileTimeToSystemTime
SystemTimeToFileTime
GetSystemTimeAsFileTime
QueryDosDeviceW
GetCurrentProcessId
GetFileAttributesW
GetDriveTypeW
CompareFileTime
LoadLibraryW
GetProcAddress
FreeLibrary
GetModuleHandleW
LockResource
GetFileSize
LocalFree
GlobalUnlock
lstrcpyW
GetLocaleInfoW
GetTempPathW
GlobalLock
SizeofResource
GetLastError
FormatMessageW
GetVersionExW
GetTickCount
GetTimeFormatW
FindResourceW
WriteFile
LoadResource
SystemTimeToTzSpecificLocalTime
ReadFile
GetModuleFileNameW
LoadLibraryExW
CreateFileW
GlobalAlloc
CloseHandle
GetSystemDirectoryW
GetWindowsDirectoryW
GetDateFormatW
FileTimeToLocalFileTime
GetTempFileNameW
WideCharToMultiByte
lstrlenW
GetCurrentProcess
GetNumberFormatW
EnumResourceNamesW
WritePrivateProfileStringW

user32

SetForegroundWindow
CallWindowProcW
MonitorFromWindow
GetDC
ReleaseDC
SetCursor
LoadCursorW
GetSysColorBrush
ShowWindow
ChildWindowFromPoint
SendDlgItemMessageW
GetMonitorInfoW
EndDialog
GetDlgItem
DrawFrameControl
SetWindowTextW
UpdateWindow
InvalidateRect
SendMessageW
GetWindowRect
SetDlgItemTextW
GetDlgItemTextW
GetDlgItemInt
SetWindowLongPtrW
GetWindowPlacement
SetDlgItemInt
GetSystemMetrics
SetWindowPlacement
EndPaint
DeferWindowPos
BeginPaint
CreateWindowExW
GetClientRect
SetMenu
TranslateAcceleratorW
SetWindowPos
GetForegroundWindow
LoadAcceleratorsW
DefWindowProcW
RegisterClassW
PostMessageW
MessageBoxW
LoadImageW
GetWindowLongW
DestroyIcon
GetSysColor
SetWindowLongW
EndDeferWindowPos
BeginDeferWindowPos
SetFocus
GetClassNameW
CheckMenuItem
GetSubMenu
InsertMenuItemW
GetMenuItemCount
SetClipboardData
EnableWindow
MapWindowPoints
GetCursorPos
CheckMenuRadioItem
GetMenuStringW
CloseClipboard
MoveWindow
GetMenu
GetParent
EmptyClipboard
EnableMenuItem
OpenClipboard
ModifyMenuW
GetMenuItemInfoW
GetDlgCtrlID
DestroyMenu
CreateDialogParamW
DialogBoxParamW
EnumChildWindows
LoadStringW
GetDesktopWindow
DestroyWindow
GetWindowTextW
LoadMenuW
SetMenuItemInfoW
GetKeyState
CreatePopupMenu
LoadIconW
DispatchMessageW
KillTimer
IsDialogMessageW
TranslateMessage
RegisterWindowMessageW
TrackPopupMenu
PostQuitMessage
InsertMenuW
GetMessageW
DrawTextExW
RemoveMenu
SetTimer
GetWindow

gdi32

SetBkMode
GetDeviceCaps
DeleteObject
GetTextExtentPoint32W
GetStockObject
SetBkColor
SetStretchBltMode
CreateCompatibleBitmap
StretchBlt
GetObjectW
DeleteDC
GetPixel
SetPixel
SelectObject
CreateCompatibleDC
SetTextColor
CreateFontIndirectW

comdlg32

ChooseFontW
FindTextW
GetSaveFileNameW

shell32

ShellExecuteExW
Shell_NotifyIconW
SHBindToParent
SHGetDesktopFolder
SHGetMalloc
SHGetFileInfoW
ShellExecuteW

Sections

.text
Size: 84KB - Virtual size: 84KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0383c61a5278f09ef37147c967080c61

Code Sign

f7:a0:a7:30:c8:7d:94:cd:83:02:e3:ea:7f:66:1b:b7Certificate

Extended Key Usages

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

5f:fd:3c:c6:9a:7c:64:83:9d:1a:1b:89:ae:09:d8:e5:a7:4b:7f:b4:c6:7f:13:7a:20:0e:14:aa:85:9a:99:37Signer

Signature Validations

Verification

07/02/2023, 20:47 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

comctl32

version

kernel32

user32

gdi32

comdlg32

shell32

Sections

.text Size: 84KB - Virtual size: 84KB

.rdata Size: 19KB - Virtual size: 19KB

.data Size: 1KB - Virtual size: 7KB

.pdata Size: 4KB - Virtual size: 3KB

.rsrc Size: 22KB - Virtual size: 22KB

f7:a0:a7:30:c8:7d:94:cd:83:02:e3:ea:7f:66:1b:b7
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

5f:fd:3c:c6:9a:7c:64:83:9d:1a:1b:89:ae:09:d8:e5:a7:4b:7f:b4:c6:7f:13:7a:20:0e:14:aa:85:9a:99:37
Signer

07/02/2023, 20:47
Valid: true

.text
Size: 84KB - Virtual size: 84KB

.rdata
Size: 19KB - Virtual size: 19KB

.data
Size: 1KB - Virtual size: 7KB

.pdata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 22KB - Virtual size: 22KB