Static task
static1
Behavioral task
behavioral1
Sample
59e408305a01d5593b23d566a26885b729423b32f58da68115e80cbf435d0bc6.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
59e408305a01d5593b23d566a26885b729423b32f58da68115e80cbf435d0bc6.exe
Resource
win10v2004-20230220-en
General
-
Target
59e408305a01d5593b23d566a26885b729423b32f58da68115e80cbf435d0bc6
-
Size
30KB
-
MD5
cd01320636622f9f609f8bdc84ec1b5e
-
SHA1
d73b1103070da510d82eed16d2e752bd8ade078b
-
SHA256
59e408305a01d5593b23d566a26885b729423b32f58da68115e80cbf435d0bc6
-
SHA512
753e004c6dca63357444e498637a2686e8de9e5a61530b999f73d55d2924fdb0125a8a6c3e17d7b5b33b0307fd69ebba849b4025cc3995568dff30629b5b0dbb
-
SSDEEP
384:qCp2BzWXIM+VJNaBAbdaJDITg9yO0qszmjnL1GoGCJEF8ZpHfW:qCDuzN+Sgum09zmzLNEFiRu
Malware Config
Signatures
Files
-
59e408305a01d5593b23d566a26885b729423b32f58da68115e80cbf435d0bc6.exe windows x86
c5e9d79662344c0260ee9b58c4edb5a0
Code Sign
22:d6:05:52:5f:df:27:a2:4d:d2:6e:0d:52:68:d2:23Certificate
IssuerCN=Kinco,O=HMI,1.2.840.113549.1.9.1=#0c0e6c696e7979406b696e636f2e636eNot Before28/04/2023, 01:52Not After31/12/2039, 23:59SubjectCN=Kinco,O=HMI,1.2.840.113549.1.9.1=#0c0e6c696e7979406b696e636f2e636e39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before03/05/2023, 00:00Not After02/08/2034, 23:59SubjectCN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02/05/2019, 00:00Not After18/01/2038, 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
47:0f:72:21:67:ae:2c:6c:77:79:7c:8f:67:b9:7e:39:dd:06:4a:e5:c7:18:ec:6e:4a:3f:43:e8:21:f0:ba:47Signer
Actual PE Digest47:0f:72:21:67:ae:2c:6c:77:79:7c:8f:67:b9:7e:39:dd:06:4a:e5:c7:18:ec:6e:4a:3f:43:e8:21:f0:ba:47Digest Algorithmsha256PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=Kinco,O=HMI,1.2.840.113549.1.9.1=#0c0e6c696e7979406b696e636f2e636e03/05/2023, 12:01 Valid: false
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WideCharToMultiByte
FreeLibrary
GetProcAddress
LoadLibraryA
OutputDebugStringA
GetModuleFileNameW
mfc42u
ord561
ord815
ord825
ord535
ord800
ord858
ord4124
ord5679
ord5568
ord2910
ord540
ord823
msvcrt
_controlfp
??1type_info@@UAE@XZ
_onexit
__dllonexit
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
_initterm
__wgetmainargs
__p___winitenv
exit
_XcptFilter
_exit
memmove
_CxxThrowException
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
wcslen
atoi
sprintf
fopen
fprintf
fclose
__CxxFrameHandler
__setusermatherr
msvcp60
??1_Winit@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
?_Xran@std@@YAXXZ
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
??_7out_of_range@std@@6B@
??1out_of_range@std@@UAE@XZ
??0out_of_range@std@@QAE@ABV01@@Z
??0logic_error@std@@QAE@ABV01@@Z
?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z
?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
Sections
.text Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 704B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 776B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ