Static task
static1
Behavioral task
behavioral1
Sample
f3491d9f9da5798b5bd26700fadb651a659d19aae2b65ef8c3531c410fb5f86a.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
f3491d9f9da5798b5bd26700fadb651a659d19aae2b65ef8c3531c410fb5f86a.exe
Resource
win10v2004-20230220-en
General
-
Target
f3491d9f9da5798b5bd26700fadb651a659d19aae2b65ef8c3531c410fb5f86a
-
Size
397KB
-
MD5
a93b7cc0e808d7137b9bf83d96d9300b
-
SHA1
2250242ece2129da9518c1b9c4247ce7065de05b
-
SHA256
f3491d9f9da5798b5bd26700fadb651a659d19aae2b65ef8c3531c410fb5f86a
-
SHA512
f49ec7c0679bf16d6c16f0297919dedc8e450aab9c6212dd3a3172c23cf9ca940a722eb93a79509c20c5bf450d41ecdc88caaa8c38f9812deeff8fd83982715f
-
SSDEEP
6144:M+jNafgL7aGXq+5vFQgAo4FiBHAhlhIDXsKqTS79ZjhlbZTUdJ4Ye:MXon1Qo4FilDXd9l1UcY
Malware Config
Signatures
Files
-
f3491d9f9da5798b5bd26700fadb651a659d19aae2b65ef8c3531c410fb5f86a.exe windows x64
6d811577c554ad57045a1d46e4cccb2c
Code Sign
02:de:c9:70:01:73:6a:b0:48:6d:89:53:0a:02:ee:5cCertificate
IssuerCN=VMware hr2 Inc.Not Before05/03/2023, 22:14Not After31/12/2039, 23:59SubjectCN=VMware hr2 Inc.90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before11/05/2022, 00:00Not After10/08/2033, 23:59SubjectCN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02/05/2019, 00:00Not After18/01/2038, 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
e4:42:97:69:60:8b:9d:1f:f0:a0:0c:b6:7f:56:64:6f:10:b5:72:c9:9c:cc:55:07:0c:95:53:f7:0c:db:d7:fdSigner
Actual PE Digeste4:42:97:69:60:8b:9d:1f:f0:a0:0c:b6:7f:56:64:6f:10:b5:72:c9:9c:cc:55:07:0c:95:53:f7:0c:db:d7:fdDigest Algorithmsha256PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=VMware hr2 Inc.09/03/2023, 18:52 Valid: false
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
shlwapi
SHCreateStreamOnFileEx
ord215
ord219
kernel32
CloseHandle
SetEvent
SetStdHandle
CreateEventW
HeapSetInformation
WaitForSingleObject
WriteConsoleW
InitializeCriticalSectionAndSpinCount
CreateFileW
HeapReAlloc
HeapSize
ReadConsoleW
ReadFile
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetProcessHeap
RtlPcToFileHeader
RaiseException
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObjectEx
Sleep
GetCurrentThreadId
GetExitCodeThread
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
InitOnceBeginInitialize
InitOnceComplete
GetLastError
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
GetModuleHandleExW
IsProcessorFeaturePresent
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEnvironmentVariableW
ResetEvent
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
ExitProcess
GetModuleFileNameW
LoadLibraryW
WideCharToMultiByte
RtlUnwindEx
SetLastError
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
RtlUnwind
CreateThread
ExitThread
FreeLibraryAndExitThread
GetStdHandle
WriteFile
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
CompareStringW
LCMapStringW
GetFileType
GetFileSizeEx
SetFilePointerEx
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
comdlg32
GetOpenFileNameW
ole32
CoTaskMemFree
CoUninitialize
PropVariantClear
IIDFromString
CoInitializeEx
CoTaskMemAlloc
StringFromGUID2
CoCreateInstance
CoGetApartmentType
CoGetObjectContext
user32
EnumWindows
Exports
Exports
r�"c8������t|o�|Փ�E˨y)K���b� �'g/-������=�R���u���t���6c!�^(=놽����pDh�<<��q:Z�&X?]^�/��e{�{@�'/r�88�I�7��9��C*`u(�#il->�� �2a����.��w��w8��O�Xk��%����B�j�<P ����vL�0�Es�Z��KstX5�(_f��_7 Z�ء��yW�e^����:�|��sv4łf)@ �{�V�}�Z#lquI/�������I[�9�E[�x��rE���8��dnG2�]t>���)��P��!*A����LU�<�\]pk���bڞK�����$� h����f8��8�4z�"�������F�7ٖ/ĕ�:9�L=�����(I��� �4D~�r�r�y5��l#w��q:t&�J��(��n[��0�_���[^��<t���=�Xs����ɰ���z�h�a���g�ZH�2�T�ϻ��k�p�n ��2Q��Ƈk�t�'��9�M�`Aa�aniEUB��o��*�QLN��s^ ���"��_ŏ8[�x�O�f��`�Glg\��Β�f5�����!P���(o��A�xI�ĸ�_�X{���ק��d�k�>@6�x�l�$-8�g"k����'b��\�FNY�ʋ�0rm�4���^���zۅs0�m��w��a�� �)�ۭf5e�¬_p �����% ����JUl0��9#W�U�T�)��C��Oov�c6Q�ԙq���B��$R��z��y��h��3�i0g"˔lG7㫂��=}u|۾Ԝ�T��Ԋ� ����[[�e��ZfwJ�tRgz�^ͯ��@�C� ��E]�0����$���}@�-e�)�z���1{�6Ɵ}�[�q�w���!���B9�L7�|�:�)>����6���m�or����E���G~��یVW�p�|�!Q��蚁F�fY=�8�l��7�.�Ȝ/e���߿d��Uof��r�R���M��.b���1'�$��b��ߑ[����$n������JA{r&_���9��i����e<2����+����+�P�2wX��M�o0����X���g-ϛ�Й!]�}K/�8E�]��EJ3� ����z[ 㜼�@��� :9C���-Xd[)M��.�A�ZK `P��Ek�0�F ��)ars}�W�6�,��룬��A�O_���t5Gq(r?�?���x����N���[?o$�t"��O���W��My��b��Ћ����./Ɣ��6!�|\��!N)t�V��Û ������f�BM^%��:�R�Y���?�A^F�Dn�3B 2,OP`Y�*&0y�:���3��]����lE�R��溔�z+�͵h�I}�m"���UE����~�Ŋ�`������������d�J7��@9����_���%/bbH5�RX��D�!�[C#�Q�8&���>��D�7����)AB�M�|��&�z��Oy��4��ֹ�S�DJ�1pWJ���Qi����+��,5��P��To�����J8鵗��M;۪�o4�aj��r�;��_pĀ��\���ՀʭWw��L:�%B�&SI�n�!��v(�L!����-JW��'ү�\�\��U"��6����@ZN&YV0����|*1G[��˒7T+�!a}�؛�9dw�2e��s��s�*�������`�c8`�0dar,���_'1 �13!����HqD??���Y�aFHٷ+Dc�Y@��2J�Ҹ�֡�[r��v��P�����M%/(A\9�\I9%���PA��D! ���)z���NT����`h����z�d�7��� eLc�G�م2W�7mw ��O3��vH�- �gl��=0qN ��mre)�E��-�3;`[j>�[P����q�ڿx����nq�)�+� �F�?��oVGs~G����!�A����u�ωF�/���to1���2(�s`�U+0D��A]�l.�S h[�C������4��VS�p��icި�K�C��d�ѿ�k�&{z4�mQZ��ۛY�9�f�d�#džYȵ��O"��4� #�%�S����k��\�����v�N�>�)��F�\.�e1�ؼM��Q�a�(�n �X(*��]�Hw�8�mc�-�ze4ŀ�Nz�+hJ[�<�E�gT߀����������"^+�YX�����+'A�� ��;O�*�6�~�V�' ]��ކ-����P'şVLmmO�2^*V`�v很���'Wp5=�\O]��r=t�ѱ�7�V 1G��2o��_5Q�{�:eWX�W���@>�E�<��^N�\)�Ҍ�C���� �CW�V�M'�xo� O�H�}0��# <��P��"Q�#���ao3�r/�UG��Pcz�������݁���ϣ��c�����\ZN �G�8����j9��������6Q��a�M, O:Dn1�k`ֆmJ�q��$����R�F^��t� �(3fwҦ>�=��$����P$ ;�l:��քkl����;J��歹���7�ʑ��G?�|/���)6{�1�|M�B�j��������N�o���h�:���P�}���,v��'��-n@Yv��AuL��T�|���絣>v���2����8���5 �jI���_�<����y��"h��݊�����Lu~\���u�?��݀�� � �����u�6 �x@��J�r}�c�H��+�,ٴ����?�)��Ժ}ul洷�<6�h�-O����֪��lh����F�p��oACnվO����ŶٳFV;u���i�Q��o9��K��z���K�)�]�a�/6�VaU�Ȭl��61� �%O���+���cm��FÐk��m���#��u�����l��`2���D �����k���JjJN�\Co�����s�O5QaE��� ����~T��-Vf,�b\�n}I��3�Y����+�IB�Q��/- cm~e\������h��Yǜ����c%��z� �g�u8*�*��(v�k�D���}�V�#���~U�ٙk��!���8�]/\�c��DKxC
Sections
.text Size: - Virtual size: 285KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 123KB - Virtual size: 122KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
DATA0 Size: - Virtual size: 77KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA1 Size: 260KB - Virtual size: 260KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ