Behavioral task
behavioral1
Sample
355375ee5b450fc944f552852bf301fac1b555e7a35c79990400a8c4b658e518.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
355375ee5b450fc944f552852bf301fac1b555e7a35c79990400a8c4b658e518.exe
Resource
win10v2004-20230703-en
General
-
Target
355375ee5b450fc944f552852bf301fac1b555e7a35c79990400a8c4b658e518
-
Size
5.2MB
-
MD5
2301f4c73eae9d251f436f685bdbe9b8
-
SHA1
5615990e3f7d893cfa632c4d6867ab70743d8307
-
SHA256
355375ee5b450fc944f552852bf301fac1b555e7a35c79990400a8c4b658e518
-
SHA512
3d44d9a511b7cecde41c3feeda5e601c43d664d3ea99dcb893ec4175b1cf2f9d06550a4cd573b23765a51d46c94cd46ab6791abb644739c704f21d854ee7ec06
-
SSDEEP
49152:J+VUkXtbryU0K6lfdWJvEQaoJgdGtR75dN1Xfuqyt820D:J0XYJfdW5taoJgdGtR75dNNfuBt8J
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
355375ee5b450fc944f552852bf301fac1b555e7a35c79990400a8c4b658e518.exe windows x64
Code Sign
63:8b:22:c9:b0:a9:d4:7f:be:68:a8:7e:82:42:e2:40Certificate
IssuerCN=S.C.H.A.L.E Independent Federal Investigation Club,ST=SCHALE,C=KivotosNot Before22-08-2023 15:54Not After31-12-2039 23:59SubjectCN=S.C.H.A.L.E Independent Federal Investigation Club,ST=SCHALE,C=Kivotos30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02-05-2019 00:00Not After18-01-2038 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before03-05-2023 00:00Not After02-08-2034 23:59SubjectCN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
84:9e:b3:56:35:61:00:25:b5:e2:f3:be:a2:2c:a7:f3:04:4b:d1:5e:69:f8:44:91:7e:c7:30:13:fe:64:10:85Signer
Actual PE Digest84:9e:b3:56:35:61:00:25:b5:e2:f3:be:a2:2c:a7:f3:04:4b:d1:5e:69:f8:44:91:7e:c7:30:13:fe:64:10:85Digest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
UPX0 Size: - Virtual size: 4.4MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 955KB - Virtual size: 956KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4.3MB - Virtual size: 4.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE