37520cb82f53fcc9d966ff630b73ac17
- SHA256 6b1c2f8bbfcaa3788d225aafa3edf378b5a9151b3e6efc9d9b3d0ee23e03b712
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Keygen.exe
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Keygen.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
SandboxieInstall3.4402.exe
Resource
win7-20231215-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral4
Sample
SandboxieInstall3.4402.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 37520cb82f53fcc9d966ff630b73ac17
- Size 1.4MB
- Sample231231-qdgrjaffcr
- SHA256 6b1c2f8bbfcaa3788d225aafa3edf378b5a9151b3e6efc9d9b3d0ee23e03b712
- MD5 37520cb82f53fcc9d966ff630b73ac17
- SHA1 8491a03b1c20992b732d086d0214971c70e6bcfb
- SHA512 ea2e9b219f56139aa26f1ab83e7aa02824ed6bf07841277170af07dd34ece4dfffe018209eb50e511ff6bb328aed17491a9694e8bd839179515afa057cb8df18
- SSDEEP 24576:hliGX9ETf4N8yijSxgSyypbj+BCyUKbUQhN6cSPFBAzo++M4e1+xq2abiBtQ:hU4N8yOsis3eUKgQL6cSdyRFbiBtQ
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Keygen.exe - NSIS installer 1 IoCs
resource yara_rule static1/unpack001/SandboxieInstall3.4402.exe nsis_installer_2
File Explorer
-
37520cb82f53fcc9d966ff630b73ac17.zip 1.4MB
-
Keygen.exe.exe 3KB
-
SandboxieInstall3.4402.exe.exe 1.4MB
Keygen.exe
- IMPHASH 2caa66d5d7e80a588fd6771e5f8273f4
- SHA256 2120be2235546d673c39930217a02a7a3273f71f808c4a35c93c2482ac2bccde
- MD5 3521e570bb4d719850447a991cd8081a
- SHA1 27b01e39ef0c9ec93351b480e593108387dfafcb
- SHA512 393030061cec11152a44a0c3fed3a4f19503d8259cdaadbc6bd000c7e3e10e179cee64427b2bf5c7005c1e813a9633954af43f6e76c88601714877b50f19fa3d
- MD5 SHA1 SHA512
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4555
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetModuleHandleA
ExitProcess
user32
GetDlgItemTextW
SetDlgItemTextW
EndDialog
DialogBoxParamA
comctl32
InitCommonControls
Name
.text
Size
1024B
Virtual Size
668B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
512B
Virtual Size
322B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
80B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=15, id=19, version=8078,
count=1, id=18, version=8444,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
SandboxieInstall3.4402.exe
- IMPHASH fde8fc6d89a103269a91db9a550eb922
- SHA256 49109d30fe59c6236dcacacf2ebda59d38450e6c2579fbb9cfc2e400436c12e2
- MD5 95854e5f024e6feb4d29bef921094f08
- SHA1 47d6df50a9ae09727418ae13db2c5d2eb3ba3c0e
- SHA512 d9f0bcbd9e0c8b8d4447a041dd5240f7257581b2cd6edae329e72b0f7536985a76b68df0211d889272ee120b23599225c2aea8146cc7c72b9153e6507fc211c3
- SSDEEP 24576:6gmP7E//07K4MjCx4SqIFBP+1C+tCuQNy0hj8gSN1NA1o+8MuqZ6Zq2KJwpoTClw:t07K4syyWt/uQM0h8gSPe7pJwpoZ
- MD5 SHA1 SHA512 SSDEEP
-
NSIS installer
PE Signature issue
Digest
51:a1:51:ac:05:b2:b5:da:9f:bb:b9:35:82:3b:55:e4:06:47:de:c4
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=SANDBOXIE L.T.D,O=SANDBOXIE L.T.D,L=Holon,ST=Israel,C=IL
Chains
Apr 17, 2010
Subject
CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:1e:44:a5:e2:4e
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jan 28, 1999 - Jan 27, 2017
Subject
CN=GlobalSign Timestamping CA,OU=Timestamping CA,O=GlobalSign
Serial Number
04:00:00:00:00:01:20:19:c1:90:66
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Mar 18, 2009 - Jan 28, 2028
Subject
CN=GlobalSign Time Stamping Authority,O=GlobalSign NV,C=BE
Serial Number
01:00:00:00:00:01:25:b0:b4:cc:01
Issuer
CN=GlobalSign Timestamping CA,OU=Timestamping CA,O=GlobalSign
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2009 - Dec 22, 2020
Subject
CN=SANDBOXIE L.T.D,O=SANDBOXIE L.T.D,L=Holon,ST=Israel,C=IL
Serial Number
01:00:00:00:00:01:25:fa:0e:5f:a5
Issuer
CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 4, 2010 - Jan 5, 2011
Subject
CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:1e:44:a5:ec:be
Issuer
CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jan 22, 2004 - Jan 27, 2017
Minor OS version
2
Major OS version
5
Entry point
5442
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvcrt
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_cexit
_XcptFilter
_exit
_c_exit
wcslen
wcscpy
kernel32
GetExitCodeProcess
GetCommandLineW
GetStartupInfoA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
FindResourceW
SizeofResource
LoadResource
LockResource
GetTempPathW
GetTickCount
CreateFileW
WriteFile
CloseHandle
GetCurrentProcess
GetProcAddress
LoadLibraryW
ExitProcess
Sleep
DeleteFileW
GetProcessHeap
WaitForSingleObject
CreateProcessW
HeapAlloc
GetStartupInfoW
user32
wsprintfW
Name
.text
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=15, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=50, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=16, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=94, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=90, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,