Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20230220-en
General
-
Target
file.exe
-
Size
1.7MB
-
MD5
7811c8e24019a783e1c72e7eeb58215f
-
SHA1
d21422ed627d291a80e08fa77d3cfc126e94d4cc
-
SHA256
b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8
-
SHA512
1f6299d5df5fa6c59f5cefe1a4b64e19511e5308c82d279d237bf1d6492fcc7e01eff349382c9dfddaf51e01f55d735849c6ba351f86a4fa437dae811efbcf10
-
SSDEEP
24576:IzYyxHFKIlJX0oXMAsksIyESF/PvWGS5JcT1pWNpFj6zpe3rNNyJfOxmsAYQCOUO:+YyjxM3kMF/Eb+o3QYQJURnCyZrxS
Malware Config
Signatures
Files
-
file.exe.exe windows x86
9c5b1e43674bd84aa54816aa5a401ae6
Code Sign
04:bd:67:99:a2:35:ca:2e:74:71:31:10:b4:98:9b:88:fe:10Certificate
IssuerCN=R3,O=Let's Encrypt,C=USNot Before29-01-2023 18:25Not After29-04-2023 18:25SubjectCN=osteopathic.org7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate
IssuerCN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=USNot Before12-01-2016 00:00Not After11-01-2031 23:59SubjectCN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate
IssuerCN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=USNot Before23-12-2017 00:00Not After22-03-2029 23:59SubjectCN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
ea:41:d0:84:6d:30:83:24:cf:63:31:bc:fd:17:2d:ff:e3:77:21:22:ba:e9:64:10:78:77:ba:6c:d4:d2:7c:31Signer
Actual PE Digestea:41:d0:84:6d:30:83:24:cf:63:31:bc:fd:17:2d:ff:e3:77:21:22:ba:e9:64:10:78:77:ba:6c:d4:d2:7c:31Digest Algorithmsha256PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=osteopathic.org27-03-2023 06:33 Valid: false
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
_amsg_exit
_initterm
_wcmdln
__setusermatherr
_XcptFilter
_exit
_cexit
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
?terminate@@YAXXZ
_except_handler4_common
_controlfp
exit
__wgetmainargs
fclose
fopen
atoi
memcpy
kernel32
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoW
InterlockedCompareExchange
Sleep
InterlockedExchange
GetModuleHandleA
GetOEMCP
WaitForMultipleObjects
GetLargePageMinimum
LocalAlloc
OpenThread
GetSystemDefaultLangID
lstrlenA
GetEnvironmentStringsW
GetProcessHeap
CreateRemoteThread
GetUserDefaultLangID
GetCommandLineA
FileTimeToSystemTime
lstrcatA
lstrlenW
FindFirstFileExA
GetLastError
SetLastError
GetProcAddress
IsValidCodePage
GlobalFree
user32
OpenIcon
IsIconic
GetMessageExtraInfo
GetTopWindow
IsZoomed
GetLastActivePopup
DrawTextA
GetParent
GetDoubleClickTime
GetDesktopWindow
IsWindow
GetDialogBaseUnits
gdi32
GetCharWidthW
SetBkMode
CreateBrushIndirect
Sections
.text Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ