Static task
static1
Behavioral task
behavioral1
Sample
f51380eb43f71c6d1b449f221b42b7430854c204875532fefdf9496dccc1f120.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
f51380eb43f71c6d1b449f221b42b7430854c204875532fefdf9496dccc1f120.exe
Resource
win10v2004-20230220-en
General
-
Target
f51380eb43f71c6d1b449f221b42b7430854c204875532fefdf9496dccc1f120
-
Size
404KB
-
MD5
65cb66545bd4afa14a29a67d5d640f44
-
SHA1
06b4215db4ecfd5e2e34a9b45510464827e7e982
-
SHA256
f51380eb43f71c6d1b449f221b42b7430854c204875532fefdf9496dccc1f120
-
SHA512
d39706d52de36ff3410722439ff33d92ed4ebb187652b2306b75c48a5ccd8eab2a97137d5218d4adfe57c8f95cdd74f4bac4928d1514fb9a1ec53bcf90296936
-
SSDEEP
6144:l+jAlV3hrVH8HpbpuUmugxycZT6RR7uAIEyhGHswYyJXHsJM:lhlVRZHikB5xPZX8swLXM
Malware Config
Signatures
Files
-
f51380eb43f71c6d1b449f221b42b7430854c204875532fefdf9496dccc1f120.exe windows x64
6d811577c554ad57045a1d46e4cccb2c
Code Sign
0e:ee:df:24:24:63:f6:ad:45:0e:58:6b:b8:51:f2:ebCertificate
IssuerCN=VMware KtM Inc.Not Before05/03/2023, 22:14Not After31/12/2039, 23:59SubjectCN=VMware KtM Inc.90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before11/05/2022, 00:00Not After10/08/2033, 23:59SubjectCN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02/05/2019, 00:00Not After18/01/2038, 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
6c:ad:87:b7:ac:31:40:2d:16:99:33:16:b2:0d:6d:1c:a4:4e:9d:ac:c1:90:c4:c5:e0:76:b4:a0:90:0e:e7:24Signer
Actual PE Digest6c:ad:87:b7:ac:31:40:2d:16:99:33:16:b2:0d:6d:1c:a4:4e:9d:ac:c1:90:c4:c5:e0:76:b4:a0:90:0e:e7:24Digest Algorithmsha256PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=VMware KtM Inc.09/03/2023, 18:52 Valid: false
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
shlwapi
SHCreateStreamOnFileEx
ord215
ord219
kernel32
CloseHandle
SetEvent
SetStdHandle
CreateEventW
HeapSetInformation
WaitForSingleObject
WriteConsoleW
InitializeCriticalSectionAndSpinCount
CreateFileW
HeapReAlloc
HeapSize
ReadConsoleW
ReadFile
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetProcessHeap
RtlPcToFileHeader
RaiseException
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObjectEx
Sleep
GetCurrentThreadId
GetExitCodeThread
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
InitOnceBeginInitialize
InitOnceComplete
GetLastError
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
GetModuleHandleExW
IsProcessorFeaturePresent
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEnvironmentVariableW
ResetEvent
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
ExitProcess
GetModuleFileNameW
LoadLibraryW
WideCharToMultiByte
RtlUnwindEx
SetLastError
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
RtlUnwind
CreateThread
ExitThread
FreeLibraryAndExitThread
GetStdHandle
WriteFile
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
CompareStringW
LCMapStringW
GetFileType
GetFileSizeEx
SetFilePointerEx
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
comdlg32
GetOpenFileNameW
ole32
CoTaskMemFree
CoUninitialize
PropVariantClear
IIDFromString
CoInitializeEx
CoTaskMemAlloc
StringFromGUID2
CoCreateInstance
CoGetApartmentType
CoGetObjectContext
user32
EnumWindows
Exports
Exports
��Bs��Q>�Cek~~7�rJn(_3R�p��+�jM4ͮ�����R��2����\�G���-��\t�n:r���Z��L� !i�s��~P�/f�U.�0�ͻ�� �S����t� `$1=MFi%����&��;�WR��ODԚ�Ԣ$[�?�}��VW�at�Z���c=���ȥ���:@���&���:���~�wC>�#�I�Ҝ�����K�/ʩf�_E�y�T�+��p(,��A�����+�bS�w�i���t��S��Ȝ&� _�|�i�W���,U�D���vtp���^%%(�Hk���_�un�����[�9q#m�h��z������cN��3��l�]4�dU���Q�o$�w����^�����л�tM��B��0l�<�*�*����_[�7���� 1R���b�p"�D�E�t��¬Φ��z=�z�$��y��j��y<,ݪ�P����Q֏��`��P�����Zڍ��I� L"����l#����쭟8�/ߎ��F^#M��f����(�%V����`b�֑�חzi=)�H}��E|�I�#�-�g%\�� v3�r�u8�$��㟃pCK�Fi�Q#'uȧյ�Ϥ��oi$�V���qW�������|���ev�l9 �R��=������ٲ��ms���|y�^��<Q�����4e�@�ٞ0����YӠ��$>���-?n�4�XP��*Y���.�>< *�qA4�bj'�ǻCȃ� �e�Ӏ�ǫ`ı8�=���t���lW��� =5���R>Ӆp�B\���Kh�B� *9kƟ�؛@c4P[��k��'��D�I��0y�(��r$d����E]yV=��)7��%k���v&y�?J�H����R���&Ƽ����A�3)�������H��5�e��a W0��Ja�Z.O+�1�S�f𓏚M�r4��s���� ~�f��]+�m����ƫ������s�$l�s����Nmg��sb�s�e�I���gav�V��T�Ma�=�bI�]���������5��g1<AE�����<��C��YY��L�蟑x}r�z���״��E+]�r6OSy�-��D�Z3S�Д���^�>J�p��<Z�7;u��@��C�͐u�����L'���`zq��gԢ��:�������O-Tk>�MD����ä@9�zn�o:nXU�!o���/��Y5�W�f!w;V����,�'��3���o6ǽU�dF%���{j�?oϻ��×���b���O�%<��쳆G+x<�kd�j/�hͫ��}�&X��q�0���Y�Cu���'�J2k�D��:{�B��Fc����Nk#"� �176�X�����j�I�8`b��큀U�)��� � 5�U�D7���Y� ���S�01K21,�;pҌZEk>��e z+�]� �.r$9e����^I)y��y�7H�NG�-L�� ��o�$�Tf�̮�\�"ڪ? �2'�L��!\BBC3Ԭ����]�0:���/8�WP�ӝ���Õb��+�Cu2v��8J>���p(�V7�f������i��7}T�02��w�W��)���i�0Ã�+!# N~��� ����ZS���I�+ �*|EK=.����iȮmO7���� 2L��#Y(��,z���W-��K��\���K��̍,��6l��+���c��-��l&�����2m9��t��n(���QC�th���6?�sd �!,r22����=Ϋ�{���o�#�C��k.� Tk��Svf���A���JD��;�%�i�k�yTO�Oy^�)�ٚ�M��2�ұpE������UM�����W9��]�nf2)L.�لu�sDj�����i��oژ�C~j�<�B��:�ɽz������j�x���*��С>kR�(�#�X]~C3��f*i����E�^Ki�荹���W�.�2���N�Zn���R�ffm�T�/o�{(?|�cƧbF������htlX�%Y�0b�ǔ��'y�Neɀ�1��_E���k��������������:��>�į{w~�N�Wy���`��FSåD���@Do�\�HzjiL�u��"��}��`3���$&2 �)0/��A.ֈ"/sA����'k/%~D�g}�����_Zm�Ϥ*$��ظ�y���@��h��W�F珸k���AP"k����c4�Š +bp1@yFr,��)-������M�SR��Y�:IocV冦�M��8M�����Ze/�Ò�D!���(_l����U��F��.�W� ٩��i�h��i7)��|�f�m�B ]~�ư���]����~n�F9�!���7eGU?)`���,e2/X�U�Lz�<c�?#��M) �+ΞcJi������onB=�P��R�Gn����&�c���vB�,�(��x�^��۰�8LE),��R -OE03/�G���Hf�Pl���^��҄Y*ʉ�2$�J�Κg�7M����B�(Hu ��A{���q�s���b6#/� �� LN�@܆�� (j�%�p鿘E��Z�J�U�Ȋ�/}��VTJ��G�$yl�+�B=J���%X_� F�Ţ�Ef�&7�9�-���-���ފ�X�fE1ˌ�x��7��NZBsT���Y�[��+�)CF./������}Yj1Q����"��M�d�h���烿)�ۢ6/���X�\ ���뺇)ϵt�zy~�>2[F=Q�Q��>�W6�.9����!>�X%���x*UӸO*$ ��J��x:���I��~�I�MJ�v���zq�u/��s���\")=��Z��kV�غceJW0f˔�<[��'����9�Ӗ-(��f��E���������֍U)3�2m <�l���=1ȭǣ��P[��֫��P]vZ�!�PP|*����$�����+Iv�R������������#�<��jp���jg�Q�R���/���:,!�X1�������tbp�II�<P_��iϒ��^�EN}q���d�s�vk��Wp������ġ暪������e�s�Z,*L�J ��ՑY�'��<e��K�X�`�&�ҷ��v�e��U��#k5�e;O �Jv7�q�*
Sections
.text Size: - Virtual size: 285KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 123KB - Virtual size: 122KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
DATA0 Size: - Virtual size: 102KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA1 Size: 268KB - Virtual size: 267KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ