Static task
static1
General
-
Target
adobe.exe
-
Size
475.6MB
-
MD5
3450e33a31a58590b7b0f76d95f1c15b
-
SHA1
ee672c96f12484c3dae64fd964a4427b3cc6565b
-
SHA256
2ba9e1fa5bac1c4ff40a3d1301e730cff2007f7bbec73997b60b679c46f304de
-
SHA512
fa3558fce1eb2549586477f080ed3f1dcc730c6d30eb9fc10c1a9b7c67ab8c906f245618855711fa26ed41216a8863f348d75af24fe8dbf5783508ac5013efa7
-
SSDEEP
49152:ZC6nMrcpEgloAXxQ8+vHe1NkQLUEHgnpY:ZNBjloAhR+/m+Ugn
Malware Config
Signatures
Files
-
adobe.exe.exe windows x86
caf9bf1d191236de3d7b150ac6f71de5
Code Sign
03:27:bb:fe:1e:93:77:52:f3:5d:79:01:a0:df:cf:fa:ac:a8Certificate
IssuerCN=R3,O=Let's Encrypt,C=USNot Before28-02-2023 13:00Not After29-05-2023 13:00SubjectCN=*.zaborfh.com7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate
IssuerCN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=USNot Before12-01-2016 00:00Not After11-01-2031 23:59SubjectCN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate
IssuerCN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=USNot Before23-12-2017 00:00Not After22-03-2029 23:59SubjectCN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
d0:ea:7d:e9:d0:31:1f:95:41:25:69:f9:bb:75:1d:ce:e8:a8:99:64:e3:79:02:87:ef:37:1e:2d:dd:e8:6a:7eSigner
Actual PE Digestd0:ea:7d:e9:d0:31:1f:95:41:25:69:f9:bb:75:1d:ce:e8:a8:99:64:e3:79:02:87:ef:37:1e:2d:dd:e8:6a:7eDigest Algorithmsha256PE Digest MatchesfalseSignature Validations
TrustedfalseVerification
Signing CertificateCN=*.zaborfh.com07-03-2023 22:46 Valid: false
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CompareFileTime
SetLastError
lstrlenW
GetUserDefaultLangID
SetEndOfFile
lstrlenA
GetModuleHandleA
GetSystemDefaultLangID
OpenProcess
IsValidCodePage
GetThreadUILanguage
LoadLibraryA
GlobalAlloc
DeleteFileW
GetThreadContext
GetProcAddress
GetProcessHeap
CreateProcessW
lstrcmpiA
GetTickCount
GetEnvironmentStringsW
OpenThread
WriteConsoleW
CloseHandle
CreateFileW
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
HeapReAlloc
HeapSize
LCMapStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwind
GetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
RaiseException
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
FreeEnvironmentStringsW
SetStdHandle
GetFileType
GetStringTypeW
DecodePointer
user32
OpenIcon
IsWindowVisible
GetShellWindow
TrackPopupMenu
ShowWindow
AnyPopup
GetForegroundWindow
IsWow64Message
IsZoomed
GetDesktopWindow
GetParent
IsIconic
GetDlgItemTextA
Sections
.text Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 31KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 958KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ