Static task
static1
Behavioral task
behavioral1
Sample
UnlockTool-2023-07-12-0.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
UnlockTool-2023-07-12-0.exe
Resource
win10v2004-20230703-en
General
-
Target
UnlockTool-2023-07-12-0.rar
-
Size
152.8MB
-
MD5
423edf9a0c34e08da156a4e3e248b4da
-
SHA1
3cc0f8a1db1622cc35d5e73092c4f9cdb598d114
-
SHA256
4a04fc75dd06841a8d818d486138a5ffaeb595661fb3ee5cca21bc51778373a7
-
SHA512
8f43637688f735ad026adad8c8a83df84151e0d4024be8ca43effaf5c1eb1dc369796b00f27aece8ee50f73965e3f129bdb0aa99ff2c47588aad5b41aa4253d7
-
SSDEEP
3145728:fwWS/tDbqnF7iuEwmM7Z+MUe3NGPWWpy5cL43fHHBPStG3sgjI:UJbiJcM7Z+M/3NapyK8HhSGI
Malware Config
Signatures
Files
-
UnlockTool-2023-07-12-0.rar.rar
-
UnlockTool-2023-07-12-0.exe.exe windows x86
54774d1d2eecaeba88a297594ea9f875
Code Sign
95:20:61:e1:f6:3f:54:58:dc:1c:84:e8:e0:6e:f3:36:83:39:c3:91:f3:25:87:eb:3d:7d:a4:5a:7a:8c:9d:b9Certificate
IssuerCN=unlocktool.net,OU=UnlockTool,O=UnlockTool,C=Ha Noi,1.2.840.113549.1.9.1=#0c18756e6c6f636b746f6f6c2e6e657440676d61696c2e636f6dNot Before15/11/2021, 05:55Not After16/11/2031, 05:55SubjectCN=unlocktool.net,OU=UnlockTool,O=UnlockTool,C=Ha Noi,1.2.840.113549.1.9.1=#0c18756e6c6f636b746f6f6c2e6e657440676d61696c2e636f6d39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before03/05/2023, 00:00Not After02/08/2034, 23:59SubjectCN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02/05/2019, 00:00Not After18/01/2038, 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
44:2f:f7:d4:31:7e:25:38:a9:6a:33:df:19:07:c3:18:2d:98:99:d9:71:6f:92:56:04:07:8c:f7:85:5a:50:b2Signer
Actual PE Digest44:2f:f7:d4:31:7e:25:38:a9:6a:33:df:19:07:c3:18:2d:98:99:d9:71:6f:92:56:04:07:8c:f7:85:5a:50:b2Digest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
timeEndPeriod
oleacc
LresultFromObject
wininet
InternetCloseHandle
winspool.drv
EnumPortsW
comdlg32
FindTextW
comctl32
ImageList_GetImageInfo
shell32
DragQueryFileW
user32
DdeSetUserHandle
CharUpperBuffW
version
GetFileVersionInfoSizeW
oleaut32
SafeArrayPutElement
netapi32
NetWkstaGetInfo
msvcrt
strncmp
advapi32
RegSetValueExW
xmllite
CreateXmlReader
kernel32
GetVersion
GetVersionExW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
wsock32
htons
ole32
CreateDataAdviseHolder
gdi32
AddFontMemResourceEx
Exports
Exports
l��ְJ���?����z|l��Z�EEǟ�~�(T$���/�T�1�A�S�0ÈB!.�O"���g��I ���'���^��j�c�E�Ԋ�V�)�@��2�����7�$�&�nsa�����M(h�fY�����d<�o��+w��� -�֤A3�$/�褳��Z���K�c�.zi�x��M~!&g��r��v G䧋�X���>��œ��w[Q��5����8\;�b�. ��y�g��#�f©�N1T�<�d0����Pc�!�)�a!�B��xH�{�;��:�/g���̛1�W�,�1�1��D����\*��#�ߜIs��2w�z �fJJMg�N�u /%�u�T����+E�'���AK�n�����a�tnX4B%�&1no���l����X#@;���&҄ӯ"Āl�Dz'K0M��g�-�c$�XRd���(%�ẗ́���}UT]?� �gZ�D�w�D���ս��k�� }��-�A_��FJ<y�����5~�Zϻ}�#�ǡ�H⣵%RZŞ�Ĥ�;��uV/���^5�v'�����:�Q�#�^C;d�W OdM� `�o����,�nc��D3��������4�>��� ^�9����m6���7����:����"��/��*��d�`�+���{ k������GO����ꣽ���:��D$"O�P�'�w��Ȼ�~Ͳ�2�N��[��߱R<�� φݥ�R)�p� Zw81�I��qU��[�V��u��@�QzKk4��O�N˰<:��`Ԛ�F�W[ ���U�b/�e��/�X;6S2�(�Q`�x��&��u�x���1�I��R�BȒ�>9�w�������n)�Xa��B4gr�3���x��kh�.��-�?�2��C�e�ҟC�ݫ�L?H���M��;ky��sa���G�O��u.�]f�`c�>C�����9�z��>�dQ<4�2���!��Ʊ�o�I@�}{=�xE��/o���Wt�U{'^MsFa������"��9�Y������]�e���VT����]�G���y^��K�B��7 j{��_�UG�%����:�_��A�O��s_g��6����❀�V y��ulM � �o���-�%};g�d���#o�E�u#M9�Vn�^�e&ɚ�����9������]�jD絉NZ�%߳�G"�X��|��{�k���i��+,���c���9��7l���\dkۅ0�g��%�2����,�~LW0~�?���4��^q� �.a��6і���ka� m�5B"���1��7z(�7�#Г�T��O))�+�2dj����ڂo�<F�~�&T�8��xU���ϴH>��ED�T#�t�\���|��NA��G6'Bd�E����}ޔ���[�S�����+��f�-:�x !+E������%�O|K�y����V��@�iƨ��I�c���2�8 �'h+��1�����M����x�|3���Mf������P��nk�>c./��x���[N.�i��&� ��������$�}�+�k�� O���I�UgI��1]��{^Kd�d�W�dɒ]�r�%��3��-hXW�T8�O��ڳ3��U@��� ��W�%�T(�C�"�g}�_��30�si��)(��B�P�J!zƾ��t(nXy�]@ V���K�J5�b��MV|�o��,�>o�l(˻���E�g�Vk�����V��5 PR��f4 �.�1`��*3�8u��8w'��(^�Ax��v�y��U�_��K�ɩ Z�kIFN5�ډ8���M0�%h�I@�q���o�0�;���PK<�I���o-\�ɋn��F¥��>��H|C�.\b �tN�)&4�-y�$G@�����硯��Y�j}��lu�ك6Fͽ�2,\SO�-ړw_|= �A�����o�k��N�ˋ�Da,w�d8D�����YkNS��7��Ք���e�{�ؑ��WuD�����4�V�REO����4�>$�~L�kN�;�����\�/�Pn�z��T���d����iFҁ�b����L9�o���`�c �>��۔#�"H����R+��ȶzpu�vB� "�4�`�A�v�֍:n]�L��5CJXic&���� ƈ��dT{���������bOq�ĥ����^r@:��/qG!�n��z��� <9�� �87w�y��̜AXo���6��V��RB��wm��c�9��E��'=�:-?h7p�Y?�ozB���w�O�|>骕��T�wi� �C�������x�6�OȬz��c�z�O���2U>�u���w�����Mye��t�a����O;ŭPK<�� �x��,+����Ntp���c�i؝���Q�'2�$��(%آ ؔ��� �_�Z]����V������V�h���3-{�&�q��Ǵ�b���cX�EiaoB�L@ل�q�Mӥ0¨;#�����W�(�%P����UK��<�WLEx�sF1%WX�=��Ѓ�I��o/�����j�=�����\�͖_�AϷĉ�T�V������Xy�V����������د�� 1�ی��C2?�X� Fn�?Y�=>^��@?�����a�g c�S�T�dqu���!hW����{�f˼ |DH�� �w �CjҠ%���aaE �`G=x���k�8?"+otZ=D�c^�jj�x�Nn��X�������><tl��ֽӠ}�����^�VT����ZH�/���%�W{9��u���aw��C�CpU�`��T��q"�o��L��� �<�^M��,3��w�����r��(@Q/�뿤���Aqܻ�? 0�X�k?o(�{v/��Y��� j�V�c�+�D �dW��*�����mF.jz�E����\�y�k�nb�)s�<|����ե���V@���[,���tC���+�� ��٤��f���ݙL7a�m<!M�������)�%����C�ʡ?��D��A)AQ��]U_��0i�����Z�U���@�~��ꡔD�d���!���u��Y8Y��'����͇�sת��n�@r��U��f|�/\?㕻��&tE����k���N��g� =��ӽ���
Sections
--rZnp3: Size: - Virtual size: 18.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
s!Yu;>V5 Size: - Virtual size: 55KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
(EZ:yEzp Size: - Virtual size: 331KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
z]wW3/^K Size: - Virtual size: 812KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
k`Q1d6UH Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
]j\>z]5H Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
^3XV/%xn Size: - Virtual size: 110B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
H'>_\Q4# Size: - Virtual size: 368B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
7=4yX<k% Size: - Virtual size: 93B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
nq.UGfZ2 Size: - Virtual size: 189.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
yiP-R?+# Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
3\N3@m)$ Size: 152.6MB - Virtual size: 152.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
mu;9&Sb" Size: 413KB - Virtual size: 413KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ