Static task
static1
Behavioral task
behavioral1
Sample
558b25ab62f5699d7ab6ff87c8e12b4f56ae3c73befcab66b31216be7e868fe2.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
558b25ab62f5699d7ab6ff87c8e12b4f56ae3c73befcab66b31216be7e868fe2.exe
Resource
win10v2004-20230220-en
General
-
Target
558b25ab62f5699d7ab6ff87c8e12b4f56ae3c73befcab66b31216be7e868fe2
-
Size
509KB
-
MD5
00778df52e8a3c40b45fbe1e15e79e53
-
SHA1
dbf278e14de380d3b02e94b9c4dff25f27f80cb6
-
SHA256
558b25ab62f5699d7ab6ff87c8e12b4f56ae3c73befcab66b31216be7e868fe2
-
SHA512
1a52cfa0e4786d454866f3ea2fd2b584369a2777fc4590ea3df4fa372d22ea7ca36f3020667e1cc26285b12b7d762bd44a270ca817c3e54045863dba241d4099
-
SSDEEP
6144:j+jpaxu1sLhbUBqfETM2mcg/knlj1T1hTz2fhwHwP9CnW2A:jGaxukbE8kpPFlRbv2KQC
Malware Config
Signatures
Files
-
558b25ab62f5699d7ab6ff87c8e12b4f56ae3c73befcab66b31216be7e868fe2.exe windows x64
6d811577c554ad57045a1d46e4cccb2c
Code Sign
59:8e:da:af:18:22:44:89:47:c8:69:b9:f3:07:35:85Certificate
IssuerCN=VMware UMF Inc.Not Before05/03/2023, 22:17Not After31/12/2039, 23:59SubjectCN=VMware UMF Inc.90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before11/05/2022, 00:00Not After10/08/2033, 23:59SubjectCN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02/05/2019, 00:00Not After18/01/2038, 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
dc:63:e2:8f:8e:57:9f:b0:0f:17:46:df:a0:69:c3:01:fc:27:45:c7:27:85:04:15:8b:71:db:d8:83:35:57:cbSigner
Actual PE Digestdc:63:e2:8f:8e:57:9f:b0:0f:17:46:df:a0:69:c3:01:fc:27:45:c7:27:85:04:15:8b:71:db:d8:83:35:57:cbDigest Algorithmsha256PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=VMware UMF Inc.09/03/2023, 18:59 Valid: false
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
shlwapi
SHCreateStreamOnFileEx
ord215
ord219
kernel32
CloseHandle
SetEvent
SetStdHandle
CreateEventW
HeapSetInformation
WaitForSingleObject
WriteConsoleW
InitializeCriticalSectionAndSpinCount
CreateFileW
HeapReAlloc
HeapSize
ReadConsoleW
ReadFile
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetProcessHeap
RtlPcToFileHeader
RaiseException
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObjectEx
Sleep
GetCurrentThreadId
GetExitCodeThread
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
InitOnceBeginInitialize
InitOnceComplete
GetLastError
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
GetModuleHandleExW
IsProcessorFeaturePresent
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEnvironmentVariableW
ResetEvent
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
ExitProcess
GetModuleFileNameW
LoadLibraryW
WideCharToMultiByte
RtlUnwindEx
SetLastError
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
RtlUnwind
CreateThread
ExitThread
FreeLibraryAndExitThread
GetStdHandle
WriteFile
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
CompareStringW
LCMapStringW
GetFileType
GetFileSizeEx
SetFilePointerEx
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
comdlg32
GetOpenFileNameW
ole32
CoTaskMemFree
CoUninitialize
PropVariantClear
IIDFromString
CoInitializeEx
CoTaskMemAlloc
StringFromGUID2
CoCreateInstance
CoGetApartmentType
CoGetObjectContext
user32
EnumWindows
Exports
Exports
������������A���)sk]BO�w������s��o�a�q�6�qW�RP Z�olZ����R�8W]�C*�O�>;o��lԏ��ˍ�i�'�nFA���:er4�� ��Ayx�Ÿ�� �"�m�P���E���c�]��۪[`p6��f�!�T����k���2_xg�m�~�r"��b�� �q���:��Í�'�!��k�0���V�}�+Si���h]�U_��T��&�h!nux���� ��vD��S�z� �X7��ۚ5�f�[m����]ҍ�x�qcn�7}���_��(���>rC��� 1�����`=�~�fQv�?18���,� ��l�h�����A���DyQu;@��d/�m�XB�_�a�D7�o��U��u�3��]�Ya��8�w>N+1\� <��.�Ңg�ыA �@S7�a�W?����]�nw �E^�?�cÄ�BʨaR��ˑk�Y[C���w���h�>�ԓjf�Ç���Ed��Z�������+8�T6:x>�U�����ߓ/��==���u��#�v���c1�}A̩fD3��0�����I���鬅+qD ý=����"��*yD��M ���>�8&���NVe�?·0_km�a�D��0?.���T���.n�B�\���X$[s�!ϙo9 '��0L���l�͞U�z3[���K�r��{43}�wj�/���ܯS�h�VG�x���������El;�]sU�A9��3���'"@R�i (ޓU��r<?�v!Z��f�`��n�֯�y�3]��9G �#� {C,��j7#^DP5b@;��#F��#��W��iLz���LڇP9�7�f��C�/�㥎�W p���3����c�$��˚�l��W|`z,�-L,�:�3�7r�u����dx�F,�*a*���?�5:����{�//������U���@l�Im�1�t�l�%<�D9Җ:@�Θ�d���'Q��x+oL/ТW!�j�g����y ��k��� 'Ou}$5�ܵ/G/_\��E}FX{e1�5�v�� �F��b�����nR(v�g��p���r�R�! ���8����co��n�u`_���1v� �D�W��Z]��%��)B�8�k���ô��w�vD�~�p�)�xz��[�E��[�"���MX+��<�J ��W�rM��&�'��"ðsz�lq�<\F���#�-/ˋ-�pw��?���^�.�AO�/*���8�J8A�k�z��� �^k:�&����4<�v��F�U $o)��]��^�8ɡ��ߓ%[�,��;( 2nÛ�Yz���`[|;��/�T�����g��l��k�ո:�S�=-��ku�l50Y�)�Xj�i����ZjI���T��C�)����&T?a��/��F�����B����>��=��F�qN/[+�����G"�{�`,h.���G�4r6����(�<tmn��8����<c���;��jA %٥?5D&kĽϬ�d��`u��٦�) �5�7��YƉd�����U-�(�J=C�4�X����!v|�%P�@�V�)K:��x�v/ԋ�Mc���r=��d���{�.<��#.��$ǀ?����&���)E�Y�A��xj��������'�8Ͽ�R��Vؔ�ܪA������/�af���3�E��5M�u�8����E� F�q���umf��fb��[�-���j������wT����4u�o�(ԟT��Ff�xD�������f�w�2��C��p�d��f���� 7`�}�ϰ¹��]u�r����U��%��D��44�ǔ����m�Qinc�"��M�b��� ��bX>9/T���ET��,�ݯ�w������ ӎ��'KK^S5<�D����}�3��"Z���h���҅n����`��l�������G�yV��>���g�L`{e �BeK �S���(�� � �Դ�I�o�jo��Y����8����^��!��Z��c���HMN��? BhmDTJ��C���(z��6�)����������^Mh�u�6��͜��-��Q3�ou�6ia��3<�� ��{ja�I/�>JÒ��_�R<�8m��K�"�3y�{��[t-+����k̷� �.H央�`L�mSJ�[G'����&Ou�W �֦��:Y�+��Il)��'V鷏2q>�0a$�'7�����s}B����tw�U�������]�|7u��1�6 �%�����^��j���������O|E���Ŭ�p��8dѓ����%�1TJo'�s>;.'���ˎ����b�j5�u�jͿ����Iz�*9<h��u��_�=j��:��ı�m�=(���sYkr�o�ItO:��+w@c�2�aN�ky�o'O�v�*��uH���Ga��A`c�27����2��O�:�1�����P.���2K�O!�#�S�v���^4�;�OU(�'ĉ�>�e��(P[�W�k�� ��a=��F�����c�ՇH��k��5���#�y6lgو=�H� ��f�ٯ%}<�'��>�! ��y3� �<yY�6�J���l�� �c��ñfyT�û<̾Ц ���bAѶ������ ͐������.P)֎�V|'���Q�6�G��Nf )0��IMr:�0�.�ֆj|T�2s�F�܉$̟�8���%Bنe��_m3KصU�O ��دZ�)LW������V\5ͶrH��L!������eNzjL�?�]�t�<�?�4�Ӑ�O��xd'�#Qڇ&�3�t�R"�� U:��|w�1@O�<�A�}�$��a�EWlRcf]G^�g%����o9�;ֹM���VJPFHN����`K�X삉������/U �t���\>��.'�����\ž[�_������Ldƈ�ާ ��ޕOy`pJ���߱�!�ӷF {��ؘ��z���(Yt�~�5=����%6����'��0qLP��̵� ��#R�<��#�-�b�� ���n�-�����Z�O�<3��.�s��2E����V/A<x�(5k�FUыnۜNR/ù�GG�pV��b��
Sections
.text Size: - Virtual size: 285KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 123KB - Virtual size: 122KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
DATA0 Size: - Virtual size: 177KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA1 Size: 373KB - Virtual size: 372KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ