Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20230220-en
General
-
Target
file.exe
-
Size
5.9MB
-
MD5
969ab9f5cfe7abf620343eb06a4bb3ba
-
SHA1
dfe71fc1701d2bf4838fd73bff1c1c0aae8afb72
-
SHA256
1fccd74cbbb38e31c5119188f94e4cc9279f3cf0bc568f0469cdbe62ab330c5d
-
SHA512
5bf7b73b850a618229661fad583bd65e2f13abde0a43e82abca36cc86cef36e476f5b03db1a7428ff470e9234deaa7b5711e37a6e5149dcbdfb47f16543cdb04
-
SSDEEP
98304:/GPNMP31DLIgWIeapkz8cWBP2ASpDSQXQ3zFvO2v7+JFn3ZVK:/GFWVIFzhWdS9XQ3zF5Dm3ZVK
Malware Config
Signatures
Files
-
file.exe.exe windows x86
496fff7f26eb25a135e9d530fa8ef62e
Code Sign
74:fb:4e:78:23:10:0e:bf:49:84:e5:49:d5:3a:62:47Certificate
IssuerCN=Acer Globe Ultra AN527-57 [AN527-77-77M3]Not Before24-03-2023 13:36Not After25-03-2033 13:36SubjectCN=Acer Globe Ultra AN527-57 [AN527-77-77M3]90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before11-05-2022 00:00Not After10-08-2033 23:59SubjectCN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02-05-2019 00:00Not After18-01-2038 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
3e:7e:a4:9a:74:a3:66:69:ae:85:19:e0:37:b0:df:02:cc:1d:59:3e:1f:57:fb:dd:fd:2e:1d:19:d8:f0:96:3eSigner
Actual PE Digest3e:7e:a4:9a:74:a3:66:69:ae:85:19:e0:37:b0:df:02:cc:1d:59:3e:1f:57:fb:dd:fd:2e:1d:19:d8:f0:96:3eDigest Algorithmsha256PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=Acer Globe Ultra AN527-57 [AN527-77-77M3]27-03-2023 18:23 Valid: false
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetModuleHandleA
GetProcAddress
user32
GetDesktopWindow
gdi32
CreateCompatibleBitmap
advapi32
SystemFunction036
shell32
SHGetFolderPathA
crypt32
CryptUnprotectData
gdiplus
GdipGetImageEncodersSize
setupapi
SetupDiGetDeviceInterfaceDetailA
Sections
.MPRESS1 Size: 5.8MB - Virtual size: 14.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 154KB - Virtual size: 154KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE