Static task
static1
Behavioral task
behavioral1
Sample
b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe
Resource
win10v2004-20230220-en
General
-
Target
7811c8e24019a783e1c72e7eeb58215f.bin
-
Size
1.4MB
-
MD5
a2f92d82ceeb7793ea8220a504883b30
-
SHA1
0ff679e96157ea8eeb36800a8533c7cf6f1d2d31
-
SHA256
d31807444bfccc0098292f170da09220ed8f5c1aaccf08d9d01c9438c7e0c4f8
-
SHA512
eb496c1c8e33ee9b62fa1b6aa99039120bdf361ff69227167b462b2330622eb5c9021555de2620c26860f5022acd2fe73628c1e09a378303ecd8a78e85742a15
-
SSDEEP
24576:U+3ZR8V8/yLMTT9qS9/DBFev0JhQ9j9rIO9DzSH2V5dU1lz3:UkZR86/yLMHH9/Di2hCJxx5dKlz3
Malware Config
Signatures
Files
-
7811c8e24019a783e1c72e7eeb58215f.bin.zip
Password: infected
-
b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8.exe.exe windows x86
Password: infected
9c5b1e43674bd84aa54816aa5a401ae6
Code Sign
04:bd:67:99:a2:35:ca:2e:74:71:31:10:b4:98:9b:88:fe:10Certificate
IssuerCN=R3,O=Let's Encrypt,C=USNot Before29-01-2023 18:25Not After29-04-2023 18:25SubjectCN=osteopathic.org7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate
IssuerCN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=USNot Before12-01-2016 00:00Not After11-01-2031 23:59SubjectCN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate
IssuerCN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=USNot Before23-12-2017 00:00Not After22-03-2029 23:59SubjectCN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
ea:41:d0:84:6d:30:83:24:cf:63:31:bc:fd:17:2d:ff:e3:77:21:22:ba:e9:64:10:78:77:ba:6c:d4:d2:7c:31Signer
Actual PE Digestea:41:d0:84:6d:30:83:24:cf:63:31:bc:fd:17:2d:ff:e3:77:21:22:ba:e9:64:10:78:77:ba:6c:d4:d2:7c:31Digest Algorithmsha256PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=osteopathic.org27-03-2023 06:33 Valid: false
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
_amsg_exit
_initterm
_wcmdln
__setusermatherr
_XcptFilter
_exit
_cexit
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
?terminate@@YAXXZ
_except_handler4_common
_controlfp
exit
__wgetmainargs
fclose
fopen
atoi
memcpy
kernel32
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoW
InterlockedCompareExchange
Sleep
InterlockedExchange
GetModuleHandleA
GetOEMCP
WaitForMultipleObjects
GetLargePageMinimum
LocalAlloc
OpenThread
GetSystemDefaultLangID
lstrlenA
GetEnvironmentStringsW
GetProcessHeap
CreateRemoteThread
GetUserDefaultLangID
GetCommandLineA
FileTimeToSystemTime
lstrcatA
lstrlenW
FindFirstFileExA
GetLastError
SetLastError
GetProcAddress
IsValidCodePage
GlobalFree
user32
OpenIcon
IsIconic
GetMessageExtraInfo
GetTopWindow
IsZoomed
GetLastActivePopup
DrawTextA
GetParent
GetDoubleClickTime
GetDesktopWindow
IsWindow
GetDialogBaseUnits
gdi32
GetCharWidthW
SetBkMode
CreateBrushIndirect
Sections
.text Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ