Static task
static1
Behavioral task
behavioral1
Sample
UnlockTool-2023-07-12-0.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
UnlockTool-2023-07-12-0.exe
Resource
win10v2004-20230703-en
General
-
Target
UnlockTool-2023-07-12-0.exe
-
Size
153.0MB
-
MD5
136b7977f4f719dbf46daa298885d9bb
-
SHA1
97eb71ff74c97c471acd758bc2f4b9aaca413e38
-
SHA256
1fad781d743168831029dbf999eeb808f73495c8958274dceeccde16211bee01
-
SHA512
b14eb05a87aa37c6be53bd5542453b60add8423154c75f9e737dce84694168a48e6c15ab16d6225e17c4189913309470eb9610af48057b491e46a2c7f2b8361c
-
SSDEEP
3145728:ZzgSOvDwTvEGUmjekec0TH4QsCQQSCk8OZMorGtfQot1d9K38Bh9:RggjEGPj4cgH4QnQQSbIfQot1dY49
Malware Config
Signatures
Files
-
UnlockTool-2023-07-12-0.exe.exe windows x86
54774d1d2eecaeba88a297594ea9f875
Code Sign
95:20:61:e1:f6:3f:54:58:dc:1c:84:e8:e0:6e:f3:36:83:39:c3:91:f3:25:87:eb:3d:7d:a4:5a:7a:8c:9d:b9Certificate
IssuerCN=unlocktool.net,OU=UnlockTool,O=UnlockTool,C=Ha Noi,1.2.840.113549.1.9.1=#0c18756e6c6f636b746f6f6c2e6e657440676d61696c2e636f6dNot Before15-11-2021 05:55Not After16-11-2031 05:55SubjectCN=unlocktool.net,OU=UnlockTool,O=UnlockTool,C=Ha Noi,1.2.840.113549.1.9.1=#0c18756e6c6f636b746f6f6c2e6e657440676d61696c2e636f6d39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before03-05-2023 00:00Not After02-08-2034 23:59SubjectCN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02-05-2019 00:00Not After18-01-2038 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
44:2f:f7:d4:31:7e:25:38:a9:6a:33:df:19:07:c3:18:2d:98:99:d9:71:6f:92:56:04:07:8c:f7:85:5a:50:b2Signer
Actual PE Digest44:2f:f7:d4:31:7e:25:38:a9:6a:33:df:19:07:c3:18:2d:98:99:d9:71:6f:92:56:04:07:8c:f7:85:5a:50:b2Digest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
timeEndPeriod
oleacc
LresultFromObject
wininet
InternetCloseHandle
winspool.drv
EnumPortsW
comdlg32
FindTextW
comctl32
ImageList_GetImageInfo
shell32
DragQueryFileW
user32
DdeSetUserHandle
CharUpperBuffW
version
GetFileVersionInfoSizeW
oleaut32
SafeArrayPutElement
netapi32
NetWkstaGetInfo
msvcrt
strncmp
advapi32
RegSetValueExW
xmllite
CreateXmlReader
kernel32
GetVersion
GetVersionExW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
wsock32
htons
ole32
CreateDataAdviseHolder
gdi32
AddFontMemResourceEx
Exports
Exports
l��ְJ���?����z|l��Z�EEǟ�~�(T$���/�T�1�A�S�0ÈB!.�O"���g��I ���'���^��j�c�E�Ԋ�V�)�@��2�����7�$�&�nsa�����M(h�fY�����d<�o��+w��� -�֤A3�$/�褳��Z���K�c�.zi�x��M~!&g��r��v G䧋�X���>��œ��w[Q��5����8\;�b�. ��y�g��#�f©�N1T�<�d0����Pc�!�)�a!�B��xH�{�;��:�/g���̛1�W�,�1�1��D����\*��#�ߜIs��2w�z �fJJMg�N�u /%�u�T����+E�'���AK�n�����a�tnX4B%�&1no���l����X#@;���&҄ӯ"Āl�Dz'K0M��g�-�c$�XRd���(%�ẗ́���}UT]?� �gZ�D�w�D���ս��k�� }��-�A_��FJ<y�����5~�Zϻ}�#�ǡ�H⣵%RZŞ�Ĥ�;��uV/���^5�v'�����:�Q�#�^C;d�W OdM� `�o����,�nc��D3��������4�>��� ^�9����m6���7����:����"��/��*��d�`�+���{ k������GO����ꣽ���:��D$"O�P�'�w��Ȼ�~Ͳ�2�N��[��߱R<�� φݥ�R)�p� Zw81�I��qU��[�V��u��@�QzKk4��O�N˰<:��`Ԛ�F�W[ ���U�b/�e��/�X;6S2�(�Q`�x��&��u�x���1�I��R�BȒ�>9�w�������n)�Xa��B4gr�3���x��kh�.��-�?�2��C�e�ҟC�ݫ�L?H���M��;ky��sa���G�O��u.�]f�`c�>C�����9�z��>�dQ<4�2���!��Ʊ�o�I@�}{=�xE��/o���Wt�U{'^MsFa������"��9�Y������]�e���VT����]�G���y^��K�B��7 j{��_�UG�%����:�_��A�O��s_g��6����❀�V y��ulM � �o���-�%};g�d���#o�E�u#M9�Vn�^�e&ɚ�����9������]�jD絉NZ�%߳�G"�X��|��{�k���i��+,���c���9��7l���\dkۅ0�g��%�2����,�~LW0~�?���4��^q� �.a��6і���ka� m�5B"���1��7z(�7�#Г�T��O))�+�2dj����ڂo�<F�~�&T�8��xU���ϴH>��ED�T#�t�\���|��NA��G6'Bd�E����}ޔ���[�S�����+��f�-:�x !+E������%�O|K�y����V��@�iƨ��I�c���2�8 �'h+��1�����M����x�|3���Mf������P��nk�>c./��x���[N.�i��&� ��������$�}�+�k�� O���I�UgI��1]��{^Kd�d�W�dɒ]�r�%��3��-hXW�T8�O��ڳ3��U@��� ��W�%�T(�C�"�g}�_��30�si��)(��B�P�J!zƾ��t(nXy�]@ V���K�J5�b��MV|�o��,�>o�l(˻���E�g�Vk�����V��5 PR��f4 �.�1`��*3�8u��8w'��(^�Ax��v�y��U�_��K�ɩ Z�kIFN5�ډ8���M0�%h�I@�q���o�0�;���PK<�I���o-\�ɋn��F¥��>��H|C�.\b �tN�)&4�-y�$G@�����硯��Y�j}��lu�ك6Fͽ�2,\SO�-ړw_|= �A�����o�k��N�ˋ�Da,w�d8D�����YkNS��7��Ք���e�{�ؑ��WuD�����4�V�REO����4�>$�~L�kN�;�����\�/�Pn�z��T���d����iFҁ�b����L9�o���`�c �>��۔#�"H����R+��ȶzpu�vB� "�4�`�A�v�֍:n]�L��5CJXic&���� ƈ��dT{���������bOq�ĥ����^r@:��/qG!�n��z��� <9�� �87w�y��̜AXo���6��V��RB��wm��c�9��E��'=�:-?h7p�Y?�ozB���w�O�|>骕��T�wi� �C�������x�6�OȬz��c�z�O���2U>�u���w�����Mye��t�a����O;ŭPK<�� �x��,+����Ntp���c�i؝���Q�'2�$��(%آ ؔ��� �_�Z]����V������V�h���3-{�&�q��Ǵ�b���cX�EiaoB�L@ل�q�Mӥ0¨;#�����W�(�%P����UK��<�WLEx�sF1%WX�=��Ѓ�I��o/�����j�=�����\�͖_�AϷĉ�T�V������Xy�V����������د�� 1�ی��C2?�X� Fn�?Y�=>^��@?�����a�g c�S�T�dqu���!hW����{�f˼ |DH�� �w �CjҠ%���aaE �`G=x���k�8?"+otZ=D�c^�jj�x�Nn��X�������><tl��ֽӠ}�����^�VT����ZH�/���%�W{9��u���aw��C�CpU�`��T��q"�o��L��� �<�^M��,3��w�����r��(@Q/�뿤���Aqܻ�? 0�X�k?o(�{v/��Y��� j�V�c�+�D �dW��*�����mF.jz�E����\�y�k�nb�)s�<|����ե���V@���[,���tC���+�� ��٤��f���ݙL7a�m<!M�������)�%����C�ʡ?��D��A)AQ��]U_��0i�����Z�U���@�~��ꡔD�d���!���u��Y8Y��'����͇�sת��n�@r��U��f|�/\?㕻��&tE����k���N��g� =��ӽ���
Sections
--rZnp3: Size: - Virtual size: 18.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
s!Yu;>V5 Size: - Virtual size: 55KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
(EZ:yEzp Size: - Virtual size: 331KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
z]wW3/^K Size: - Virtual size: 812KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
k`Q1d6UH Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
]j\>z]5H Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
^3XV/%xn Size: - Virtual size: 110B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
H'>_\Q4# Size: - Virtual size: 368B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
7=4yX<k% Size: - Virtual size: 93B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
nq.UGfZ2 Size: - Virtual size: 189.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
yiP-R?+# Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
3\N3@m)$ Size: 152.6MB - Virtual size: 152.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
mu;9&Sb" Size: 413KB - Virtual size: 413KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ