Static task
static1
Behavioral task
behavioral1
Sample
272bbe1f8b88ccb668568895e3179acc.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
272bbe1f8b88ccb668568895e3179acc.exe
Resource
win10v2004-20231215-en
General
-
Target
272bbe1f8b88ccb668568895e3179acc
-
Size
278KB
-
MD5
272bbe1f8b88ccb668568895e3179acc
-
SHA1
85b1ebc05cd045f86d25ae919c791ff51a948c80
-
SHA256
e45e1feb7696332455ba17cefe4fbca6675a79a4ceb56fd9ff57cfab2c7cd3bb
-
SHA512
489d87101bf582e8bf2666713d30878e2c88eeea47400d0a0871bc751880ecad5c87f1a81a5da97ec2135f6d83c5109c065093359f02fa996ac29e4952569ced
-
SSDEEP
6144:yR8KlDHSrtf5Sl7v4t4ygL7q9RSt9KdMOnAE:y55H8fUlr4iDfOSEAE
Malware Config
Signatures
Files
-
272bbe1f8b88ccb668568895e3179acc.exe windows:4 windows x86 arch:x86
05bc85ed68c8d69d1bbd1bb352943c6c
Code Sign
01Certificate
IssuerCN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6dNot Before01-08-1996 00:00Not After31-12-2020 23:59SubjectCN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d0aCertificate
IssuerCN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6dNot Before06-08-2003 00:00Not After05-08-2013 23:59SubjectCN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZAExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
01:d1:51:d4:6a:31:f4:d1:ff:4e:3a:0a:8a:ec:82:0fCertificate
IssuerCN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZANot Before16-06-2008 00:00Not After30-05-2010 23:59SubjectCN=Foxit Software Company,OU=SECURE APPLICATION DEVELOPMENT,O=Foxit Software Company,L=San Jose,ST=California,C=USExtended Key Usages
ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
c4:76:a7:0c:1d:dc:df:8b:d7:c1:cd:43:3d:4c:f1:11:3f:ab:a7:99Signer
Actual PE Digestc4:76:a7:0c:1d:dc:df:8b:d7:c1:cd:43:3d:4c:f1:11:3f:ab:a7:99Digest Algorithmsha1PE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ReplaceFileA
WaitForMultipleObjects
GetNumberFormatA
MulDiv
lstrcmpW
lstrcpyn
Sleep
GetProcAddress
lstrcpynW
LoadResource
EnumTimeFormatsA
GetStringTypeW
GetSystemInfo
GetWindowsDirectoryA
GetCurrentThread
BeginUpdateResourceW
IsBadWritePtr
GetOEMCP
lstrcatW
FatalAppExitW
RaiseException
FileTimeToDosDateTime
lstrlenA
GetStringTypeA
CreatePipe
CreateDirectoryA
GetAtomNameA
EnumCalendarInfoA
SystemTimeToFileTime
ExitProcess
CompareFileTime
OpenSemaphoreW
ReplaceFileW
CopyFileExW
GetLogicalDriveStringsA
WaitForSingleObject
FindAtomW
GetCalendarInfoA
GetThreadPriority
SetErrorMode
AddAtomW
GetLocaleInfoW
lstrcatA
CopyFileA
IsDebuggerPresent
IsBadReadPtr
SetLocaleInfoA
GetExitCodeThread
MoveFileA
GetLogicalDriveStringsW
CreateMailslotA
LocalAlloc
GlobalFindAtomW
GetTickCount
GetLocalTime
OpenMutexW
GetLongPathNameW
GlobalAlloc
InitializeCriticalSection
GetVersionExW
GetStartupInfoW
MoveFileW
FatalAppExitA
MultiByteToWideChar
SetComputerNameA
EnumDateFormatsW
GetCurrentDirectoryW
DeleteAtom
GetThreadLocale
OpenFile
GetTimeFormatA
IsBadCodePtr
HeapCreate
GetEnvironmentStringsW
LoadLibraryA
GetProcessHeap
GetSystemDefaultLCID
lstrcpy
SetCalendarInfoA
Beep
user32
GetMenu
CharUpperW
WinHelpA
GetDlgItemTextW
GetClassInfoExA
TrackPopupMenuEx
EnableWindow
LoadBitmapA
CharUpperA
LoadMenuA
InvalidateRect
GetClassInfoW
PostMessageW
GetDlgItemTextA
CreateAcceleratorTableA
AppendMenuW
AppendMenuA
MessageBoxW
LoadIconW
GetWindowRgn
GetKeyboardType
IsMenu
LoadBitmapW
oleaut32
VarBstrFromDisp
olecli32
ErrExecute
ErrClose
inetcomm
MimeOleGetBodyPropW
MimeOleParseRfc822Address
MimeOleCreateMessageParts
EssKeyExchPreferenceEncodeEx
MimeOleParseMhtmlUrl
EssReceiptRequestDecodeEx
MimeOleCreateSecurity
oledlg
OleUIEditLinksW
Sections
.fj Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UfPOkc Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.X Size: 3KB - Virtual size: 346KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.NGr Size: 1KB - Virtual size: 341KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.SE Size: 109KB - Virtual size: 109KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vd Size: 11KB - Virtual size: 177KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.XGJ Size: 109KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.Qi Size: 4KB - Virtual size: 343KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.yUDSI Size: 4KB - Virtual size: 200KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xkOh Size: 3KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.OsPo Size: 3KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ