Static task
static1
General
-
Target
UnlockTool-2022-06-29-0.exe
-
Size
131.0MB
-
MD5
19c6bb0484c6e212409c834f2b676171
-
SHA1
389f11986225a76b2624601e287de8171422b918
-
SHA256
4e06136e7c234580df49534da833f815f36811f5a8b2a98020c6903cdab9b293
-
SHA512
a5a52efc168921fc11b6ae8b251b6b9268c35b78131987fdc353ffb24e0c0681d7841f62248b79c7222113d675ccebe284b038569a897fc06004706a81ba8120
-
SSDEEP
3145728:dUTuEbpn9QkolhN2KdsPIkjfnWjK77n19OjhjRNNFa:dnsn9ToI3bfnWQT2Zm
Malware Config
Signatures
Files
-
UnlockTool-2022-06-29-0.exe.exe windows x86
d2df0ea7fac3fee651f1ef1968896b29
Code Sign
95:20:61:e1:f6:3f:54:58:dc:1c:84:e8:e0:6e:f3:36:83:39:c3:91:f3:25:87:eb:3d:7d:a4:5a:7a:8c:9d:b9Certificate
IssuerCN=unlocktool.net,OU=UnlockTool,O=UnlockTool,C=Ha Noi,1.2.840.113549.1.9.1=#0c18756e6c6f636b746f6f6c2e6e657440676d61696c2e636f6dNot Before15/11/2021, 05:55Not After16/11/2031, 05:55SubjectCN=unlocktool.net,OU=UnlockTool,O=UnlockTool,C=Ha Noi,1.2.840.113549.1.9.1=#0c18756e6c6f636b746f6f6c2e6e657440676d61696c2e636f6d90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before11/05/2022, 00:00Not After10/08/2033, 23:59SubjectCN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02/05/2019, 00:00Not After18/01/2038, 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
7e:fc:9c:c0:9a:92:59:5a:6a:46:19:52:28:13:f0:b3:f4:d3:7e:92:4c:f1:01:fb:35:97:69:c0:3c:89:31:3cSigner
Actual PE Digest7e:fc:9c:c0:9a:92:59:5a:6a:46:19:52:28:13:f0:b3:f4:d3:7e:92:4c:f1:01:fb:35:97:69:c0:3c:89:31:3cDigest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
winmm
timeEndPeriod
oleacc
LresultFromObject
wininet
InternetCloseHandle
winspool.drv
EnumPortsW
comdlg32
FindTextW
comctl32
ImageList_GetImageInfo
shell32
DragQueryFileW
user32
CopyImage
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
version
GetFileVersionInfoSizeW
oleaut32
SafeArrayPutElement
msvcrt
strncmp
advapi32
RegSetValueExW
netapi32
NetWkstaGetInfo
winhttp
WinHttpGetIEProxyConfigForCurrentUser
xmllite
CreateXmlReader
kernel32
GetVersion
GetVersionExW
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
wsock32
htons
ole32
CreateDataAdviseHolder
gdi32
AddFontMemResourceEx
wtsapi32
WTSSendMessageW
Exports
Exports
M�Y,3�~F���괏��c���d�s7Sj����d�I??�OA��;�U;'���-a�&Ӈ/��_Y!K���d@ �/�`� ă;�����7�3�y��,l����4�!9!��Ie�n�%�_� 7(u��ח�Vib�X��|��`C<�%�9��D[��!����֒�;�0뻥�PCkw���<��˾�Xo���ѧT1q�=�$F�>����ɷ�����c�k�b�USVhmI�F����o8:R����:]�0C�5)ۍ�^���).�|����s\W*yH�C���L��t剅(Y���J�A�/:w��.�R?b��9�!}����M�W}Ă��������~~'T(�\ϊ����0ק�7����#�Ӟ��\?y�FXn��õy+}���0@>9V�,�@��+s�?[�l/j�Ԍ��<$)*�(�3����`�my[��-6<�~�y+#_��~&��4��(B�����xop�e@�s�Fj p��ǒT�� �>���l��TN��o��A$#�~��_.��^�Z�4�X(�\��~��|�t����� v��ם��}S�dQ.+-� ��|)�`��uO��7��YǃQx��Qn!h� �k̿����'��jQxCZCy�i�$��,����Fh���B�����2� X���2)����ip�r���{��{�H�(�a��]��q��\2�E��熛�2��<k��HW�{�~H%�umv�%.���znE]�w~��Iܖ)T�;҂�^T5� �.%]�����q� ��V��+,�_��Eai�3+�%���H����'�"���@$���/�_&V߶�<�Α�Kg����� �O}��"bG��C��G @��B�S�$�0F�O���.I�L�d�x^�2��th�����k.pO=�"�A�āϕ*���H[䴧vX% =���h�q1��I���Ts�6��&�NA��8:���@5-z����0L�NHa-�7L<6���*[���|����9��Cd�����]���1�B@�]�.�+1;�4�W|�;�7��} 4:wZ�\U����f�U��1cj��+�پ ��qK��$����Ӵ�m�݉�=��c��ڢS̓�ܗ9!�,A��SZ�As��K�H�9�l�kߢ���={�9q9Ŗ�&�xOKXiD��G�`�#���# ��Ɖ�S��mD��N�hp�M��<@o��R�OO��8�_�v�uG��d5���jI�0�Ra�}\�V�d;w<Gg���K+���SS�U:Spkt@��;}���Sofv��[� ���@Sˎ�l���N�|�䂋���a�K�ר�Հt��r��7�4��� ��Mzl1�y�s� yh��ݰ�TC�(EiW[9���2��o�[��six�0�R�� oTG�2�{W-��8�kA�����<�LF���x�����>�#_cy�O�)<*z{���6f����P=��k\�����8 e]��X�+0~e�1�u�hG���Ֆ�Gz��^��Ya�&��������N��8w1��G���Q!X�n�mL��4Β ��u��^�ex���B�=�CC����"����&���0�^S8�/��t;�ٚ5��n �iv�qA�T K*�Sw���#䊔��\�y���5I�ʂ�l�m�Ʃ�g��8�,�e��j���w�����gp=��"�ݪnB��.�M;$��']%=��ꔗ�f*���5�r��]i�㤫+]��G* �n �S�G�̅�� G&��'5ERn6���y���'�bg�Tg����c)�ʰ×��#��X%&HZ4�b����%����%8w��E����uO�dL� n�o�m~� L�u�D��[v��e�Q�ǩo��t2qxń(H��u<���:w��%�h�cw�ơ�+[w\����"�U4�C4{%���_�+������b���XK�ݽ��s����-��ES��`�q�i>Y���僿/���n����Э���`%L�{��F5�1�/9�Q���"bƙ4F��tU�qH��` -nOY"m����S�&OW���n`�S4x�My;�V����vC��B�J��^�Wp�M��[�� (nS�3��.��};꿏t�(W萭�@�h5ٶ�����'n��Y�ۻҢ�-,��R��t�"��* j4�e����I� ���Q�T+R3����]�l푚Pd$���[̞���"8�s�d�P���X\k�����ݯ%����\4������%m���%ƪ������R�xP����3�Ŷ����?� ��~����%� �8�E*�t� R8>o$��lG1� uJ�96��J'�r��mdV�6F�����R�����g^���B��&h^~���[��l�">_Ì) /yMQ2̅�����ܻS-�9�p{�z�������}��y*I}k���@�ɠ�M v��ƀtYA�!�nt�nxEL�az���[��HPѯ+�+�������,��H�ȉ���<�����!kC��;+�D�~J8�Wa鹷@ {�������#��̯_?�~�G��Kt�����z�FB�dÜ4C(�Eq��d��c��"�V���L��-foG����pU��ol�ȶ��Zp#s�g&y� )�Y&L��ӌ�V]�E_3dY����)�KHKD^�:4���cU�-�bd� n� 4��z+7'����K�=g�Z�ַ�\"4���T��{��Q {��a1b�����!���VX����s$���q�ɜ����?y�q�ҍ�4+����hY�'��2I��n0i���.����� M4�NoJ����D�v?�����Ϯ��ZqR��<�6Wƴ0�Q�G0:��@\��Xl��.�\��v ��M<PŌ��J�<��{d�_�z|��J�~r��hnBs\fv�EE��ތ��Lg�rZ��������爷���w��=o5�Q�7c*���i4����R֦������Z�)}���\�U�B�2�k=����!4��0�p�����X��Ew����<`_�P�ш�gtI��i��%{1���])1LJs*�c�ù6��p���.#,t��! � ev@�9���
Sections
KmL5P-+9 Size: - Virtual size: 17.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
97oA0HSj Size: - Virtual size: 53KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
La=0;<CN Size: - Virtual size: 325KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
RA+th(SS Size: - Virtual size: 809KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
:<,5-MJ5 Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
&0E;Vyu> Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
*-qjYWZN Size: - Virtual size: 151B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
o`5K=TBv Size: - Virtual size: 384B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
`#a'&D]v Size: - Virtual size: 93B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
EnG;5`Bo Size: - Virtual size: 150.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
'4C&(WGo Size: 130.5MB - Virtual size: 130.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
&PpRddk7 Size: 413KB - Virtual size: 413KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ