Static task
static1
Behavioral task
behavioral1
Sample
sumthin.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
sumthin.exe
Resource
win10v2004-20230220-en
General
-
Target
sumthin.exe
-
Size
2.9MB
-
MD5
194581131c0fd49fc8c91b0af260943a
-
SHA1
6b34925aa2892011aad7f72e167dbac966bf6e39
-
SHA256
05ea5a2c58c71d1b554a0582117ef31b9bd7f9b83d21f4dcf19b3d6e94b4cc58
-
SHA512
cf805a1ef9fa1b199e98c684d217a66c9ab79b476e9498353fa8b8640eaf5ee67d477f15dd25291796668239c43fafc11a6109b646ae778c1149397e17bcc641
-
SSDEEP
49152:CG8VnqJRx8uIHCDch7UPBltq9b9fr+ZqleaNpM/OFX8qE4xq5mCfu1pYhec7bO3:DsnqvIHC+7Szq9bQ2KqE4xq5mGApYhtW
Malware Config
Signatures
Files
-
sumthin.exe.exe windows x86
b79a2e9b945e7165b2166fa98e7c2334
Code Sign
01Certificate
IssuerCN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6dNot Before01-08-1996 00:00Not After31-12-2020 23:59SubjectCN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d0aCertificate
IssuerCN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6dNot Before06-08-2003 00:00Not After05-08-2013 23:59SubjectCN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZAExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
4d:3c:7d:0e:e7:72:0f:4d:58:98:2e:bd:53:c1:4f:f9Certificate
IssuerCN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZANot Before09-09-2008 00:00Not After09-09-2010 23:59SubjectCN=eSellerate,OU=SECURE APPLICATION DEVELOPMENT,O=eSellerate,L=Lincoln,ST=Nebraska,C=USExtended Key Usages
ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
ef:b8:5f:a2:4b:34:cf:da:b2:b5:5d:47:ce:74:1f:3e:a5:32:08:9fSigner
Actual PE Digestef:b8:5f:a2:4b:34:cf:da:b2:b5:5d:47:ce:74:1f:3e:a5:32:08:9fDigest Algorithmsha1PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=eSellerate,OU=SECURE APPLICATION DEVELOPMENT,O=eSellerate,L=Lincoln,ST=Nebraska,C=US30-03-2023 10:56 Valid: false
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
wininet
InternetSetCookieA
kernel32
CompareFileTime
FreeLibrary
GetLastError
CloseHandle
GetExitCodeProcess
Sleep
OpenProcess
SetLastError
GetProcAddress
LoadLibraryA
GetVersion
GetFileAttributesA
FindFirstFileA
_lwrite
_lread
CreateProcessA
lstrlenA
lstrcatA
HeapFree
GetLogicalDriveStringsA
GetDriveTypeA
GetDiskFreeSpaceA
RemoveDirectoryA
_lclose
_lcreat
CreateDirectoryA
DeleteFileA
GetTempFileNameA
GetTempPathA
_llseek
_lopen
GetModuleFileNameA
SetStdHandle
GetSystemInfo
VirtualProtect
GetLocaleInfoA
VirtualQuery
GetProcessHeap
HeapAlloc
HeapReAlloc
FlushFileBuffers
FormatMessageA
HeapSize
lstrcpyA
ExitProcess
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersionExA
GetACP
GetOEMCP
GetCPInfo
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
WriteFile
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
SetFilePointer
RtlUnwind
InterlockedExchange
user32
PeekMessageA
TranslateMessage
DispatchMessageA
MessageBoxA
advapi32
RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegEnumKeyExA
RegCloseKey
Sections
.text Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ