Behavioral task
behavioral1
Sample
f0e0e17a24223a3ae38281c669b9e9702cb63f41859bcb4f489a9048795e27ba.exe
Resource
win7-20230712-en
General
-
Target
f0e0e17a24223a3ae38281c669b9e9702cb63f41859bcb4f489a9048795e27ba
-
Size
6.5MB
-
MD5
047b5d2075c2d6610b0b63c34d0455be
-
SHA1
f5a29ddd6f1df5da62250f93094b754043cc586c
-
SHA256
f0e0e17a24223a3ae38281c669b9e9702cb63f41859bcb4f489a9048795e27ba
-
SHA512
6125cf9ab5cc9282a98867882207d0d5115970cc49bdbcdeea485995b66248e05dedf52f7246622d34b061687d8838edcce89338bb1623ba57ec9bd1d4086582
-
SSDEEP
196608:ohcmcCw4eb7tPjA5rAoYpB+2u54AXDkQcRDt8yhm0FpGn:ohPcfDtPc5sXpB+2umGd4DthtFO
Malware Config
Signatures
-
Processes:
resource yara_rule sample vmprotect
Files
-
f0e0e17a24223a3ae38281c669b9e9702cb63f41859bcb4f489a9048795e27ba.exe windows x86
47d9e0a75345ea39609c757c684fd925
Code Sign
24:c8:47:7e:dd:13:46:a1:4a:8e:39:13:06:76:18:3fCertificate
IssuerCN=Nokia 110 4G DS (2021) TurquoiseNot Before22-06-2023 13:04Not After23-06-2033 13:04SubjectCN=Nokia 110 4G DS (2021) Turquoise39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before03-05-2023 00:00Not After02-08-2034 23:59SubjectCN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02-05-2019 00:00Not After18-01-2038 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
f2:43:37:e9:58:42:3c:81:b2:2b:9e:69:8e:66:ee:e1:8a:e9:cc:d8:3e:43:84:d4:53:6d:43:07:e5:1f:9d:79Signer
Actual PE Digestf2:43:37:e9:58:42:3c:81:b2:2b:9e:69:8e:66:ee:e1:8a:e9:cc:d8:3e:43:84:d4:53:6d:43:07:e5:1f:9d:79Digest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
advapi32
RegCloseKey
shell32
SHGetFolderPathA
wininet
HttpOpenRequestA
user32
CharUpperBuffW
Sections
.text Size: - Virtual size: 166KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 6.3MB - Virtual size: 6.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 202KB - Virtual size: 653KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ