Static task
static1
Behavioral task
behavioral1
Sample
PLAYGROUND PROJECT - 2022089928 - KDF.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
PLAYGROUND PROJECT - 2022089928 - KDF.exe
Resource
win10v2004-20230220-en
General
-
Target
PLAYGROUND PROJECT - 2022089928 - KDF.exe
-
Size
201KB
-
MD5
f146bcc2abb69258688b0346b6755b7f
-
SHA1
65761c290d29c603b28a04f44d367659aec5ad9d
-
SHA256
c1a82c6f221c8285b77caf7af892cb54cb62970ad9952d8bd715ec12fb4e2d8e
-
SHA512
aba27034ab40d1e2451d156bf9f9c01077e9c2a7e8b16e67bfe3c55762063f747de3a0fd6890658625cdb0a3fbdab87b40d2985e6e3eab9aafa2f64b72f9642d
-
SSDEEP
3072:8mdrb05ZNgXJmMYyNbcII4EJsm+X2qBGKYZd8Fh/28CRfJVxMv/TmGxaK7:hR0+gSND9Eum+XjBGXqO8C5mv/SGP7
Malware Config
Signatures
-
NSIS installer 2 IoCs
resource yara_rule sample nsis_installer_1 sample nsis_installer_2
Files
-
PLAYGROUND PROJECT - 2022089928 - KDF.exe.exe windows x86
e990dd07e89d04c53e337ab9b3f5e0cc
Code Sign
03:c3:c2:fa:63:78:d6:57:8c:a0:f3:47:59:7d:32:48:95:b7:fc:eeCertificate
IssuerOU=Destined Devolatilize\ ,O=Paamindelser,L=Nouans-les-Fontaines,ST=Centre-Val de Loire,C=FR,1.2.840.113549.1.9.1=#0c1a4e6f6e76696e6f73697479405269746f726e656c6c65722e4261Not Before17/08/2022, 06:45Not After16/08/2025, 06:45SubjectOU=Destined Devolatilize\ ,O=Paamindelser,L=Nouans-les-Fontaines,ST=Centre-Val de Loire,C=FR,1.2.840.113549.1.9.1=#0c1a4e6f6e76696e6f73697479405269746f726e656c6c65722e42617b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate
IssuerCN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=USNot Before12/01/2016, 00:00Not After11/01/2031, 23:59SubjectCN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate
IssuerCN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=USNot Before23/12/2017, 00:00Not After22/03/2029, 23:59SubjectCN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
f4:a4:c4:ca:b1:5a:d3:d3:1b:96:3e:e4:07:ca:21:72:3c:bb:35:57:67:d1:3a:f7:a4:02:03:fd:2f:f7:6b:ecSigner
Actual PE Digestf4:a4:c4:ca:b1:5a:d3:d3:1b:96:3e:e4:07:ca:21:72:3c:bb:35:57:67:d1:3a:f7:a4:02:03:fd:2f:f7:6b:ecDigest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Sleep
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
CompareFileTime
SearchPathA
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetEnvironmentVariableA
SetFileAttributesA
lstrcmpiA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrlenA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrcpyA
lstrcatA
GetSystemDirectoryA
GetVersion
GetProcAddress
WaitForSingleObject
SetFileTime
CloseHandle
GlobalFree
lstrcmpA
ExpandEnvironmentStringsA
GetExitCodeProcess
GlobalAlloc
GetModuleHandleA
LoadLibraryExA
GetTempPathA
GetWindowsDirectoryA
FreeLibrary
FindFirstFileA
FindNextFileA
DeleteFileA
SetFilePointer
ReadFile
FindClose
GetPrivateProfileStringA
WritePrivateProfileStringA
MulDiv
WriteFile
MultiByteToWideChar
user32
CreateWindowExA
EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
GetDC
SystemParametersInfoA
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
ReleaseDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
DestroyWindow
CreateDialogParamA
SetTimer
GetDlgItem
wsprintfA
SetForegroundWindow
ShowWindow
IsWindow
LoadImageA
SetWindowLongA
SetClipboardData
EmptyClipboard
OpenClipboard
EndPaint
PostQuitMessage
FindWindowExA
SendMessageTimeoutA
SetWindowTextA
gdi32
SelectObject
SetBkMode
CreateFontIndirectA
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
advapi32
RegCloseKey
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegEnumValueA
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegEnumKeyA
comctl32
ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17
ole32
CoCreateInstance
CoTaskMemFree
OleInitialize
OleUninitialize
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Sections
.text Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 107KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ndata Size: - Virtual size: 76KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ