Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20230220-en
General
-
Target
tmp
-
Size
1.4MB
-
MD5
0f16ee89f88b541aea1867c8b6b44868
-
SHA1
efa65c4c60ab0123246b10b300b4a11fe0eba325
-
SHA256
0002ab37c265250dc388afc14e44b8b9362d941db7634df5bad9fa7d7c287b19
-
SHA512
8f9f477d5a1a217d8080b2f008084b7f87ab14263c5f7f3c16250c4d7112e825b4a8bb1646e964222d91a167566bde3010960d17cb1f789567054b12aa616855
-
SSDEEP
24576:J7u0QUm8sMWyLCB3aO+AhcE/evoBNMhgNkTjR2iRRZj0tJqeRXigd0ojgKa8LAqx:tFDAMcMhgNmF7ZIue5igd9pGqx
Malware Config
Signatures
Files
-
tmp.exe windows x86
06a097e0e1da8bc7de03cf1b2644e8f7
Code Sign
04:bc:8a:30:33:5f:57:f1:9c:ab:98:bd:09:b4:0c:ab:85:2eCertificate
IssuerCN=R3,O=Let's Encrypt,C=USNot Before12-02-2023 02:11Not After13-05-2023 02:11SubjectCN=www.ref.ac.uk7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate
IssuerCN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=USNot Before12-01-2016 00:00Not After11-01-2031 23:59SubjectCN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate
IssuerCN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=USNot Before23-12-2017 00:00Not After22-03-2029 23:59SubjectCN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
89:b9:05:58:d9:32:48:ef:ac:cd:4f:cd:cc:66:8f:80:b9:a3:f4:26:5b:dd:48:a5:41:7a:59:05:36:61:eb:f5Signer
Actual PE Digest89:b9:05:58:d9:32:48:ef:ac:cd:4f:cd:cc:66:8f:80:b9:a3:f4:26:5b:dd:48:a5:41:7a:59:05:36:61:eb:f5Digest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcessHeap
GetUserDefaultLangID
lstrlenW
GetLastError
GetCurrentDirectoryW
SetLastError
lstrcmpiA
GetProcAddress
IsValidCodePage
GetLocalTime
LoadLibraryA
LocalAlloc
SetCurrentDirectoryW
lstrlenA
GetModuleHandleA
VirtualProtect
QueryPerformanceFrequency
OutputDebugStringA
FlushFileBuffers
CloseHandle
CreateFileA
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetConsoleMode
GetOEMCP
GetCommandLineW
GetConsoleCP
SetFilePointer
GetStartupInfoW
HeapValidate
IsBadReadPtr
RaiseException
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleHandleW
Sleep
InterlockedIncrement
InterlockedDecrement
ExitProcess
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
HeapDestroy
HeapCreate
HeapFree
VirtualFree
GetModuleFileNameA
WriteFile
HeapAlloc
HeapSize
HeapReAlloc
VirtualAlloc
GetACP
GetCPInfo
InitializeCriticalSectionAndSpinCount
DebugBreak
WriteConsoleW
OutputDebugStringW
LoadLibraryW
RtlUnwind
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
user32
IsWindowVisible
GetLastActivePopup
GetParent
IsWindowEnabled
AnyPopup
GetDoubleClickTime
CheckDlgButton
IsWow64Message
advapi32
RegQueryValueExW
ole32
OleInitialize
Sections
.text Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 968KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ