Static task
static1
Behavioral task
behavioral1
Sample
c807510b37c8650a2a2df4d6965f19be2681b68415e25770b31a098d60dd5200.exe
Resource
win7-20231215-en
General
-
Target
c807510b37c8650a2a2df4d6965f19be2681b68415e25770b31a098d60dd5200
-
Size
5.5MB
-
MD5
f1aae4c72096e3450687b8843af5fcdd
-
SHA1
2b2fe311867179acb6c02f9a43055e10d57d361b
-
SHA256
c807510b37c8650a2a2df4d6965f19be2681b68415e25770b31a098d60dd5200
-
SHA512
3161c92a6cac7437244feb422fdb5332c7e029f1473b8f2fbf40571bb35174a652749f9e4394562a360dea815589bf07ff4cdf15ff0f61678c956c347d65196f
-
SSDEEP
98304:85VeM3KT9YbnSXVxboQokmPgQphPrBCiXGDdYygG+VBbQUyMQXDuYlxCUQEfJe:85KhYbKLk2mTphPGP6H8NEY7plk
Malware Config
Signatures
Files
-
c807510b37c8650a2a2df4d6965f19be2681b68415e25770b31a098d60dd5200.exe windows:6 windows x86 arch:x86
39b684c6739e5cf88420ec5fa8245f88
Code Sign
1f:a1:bc:d2:69:4a:d6:9d:44:59:7b:33:af:f5:78:56Certificate
IssuerCN=ActiveReports RDF document 2024 APINot Before07/01/2024, 13:51Not After08/01/2034, 13:51SubjectCN=ActiveReports RDF document 2024 API39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before03/05/2023, 00:00Not After02/08/2034, 23:59SubjectCN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02/05/2019, 00:00Not After18/01/2038, 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
23:67:26:15:f5:9a:ab:c1:f5:4f:f7:5a:c7:df:9b:b8:d4:1b:b9:66:ee:47:42:06:4f:a1:96:e3:1c:ee:5b:2eSigner
Actual PE Digest23:67:26:15:f5:9a:ab:c1:f5:4f:f7:5a:c7:df:9b:b8:d4:1b:b9:66:ee:47:42:06:4f:a1:96:e3:1c:ee:5b:2eDigest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
AcquireSRWLockExclusive
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetDC
GetProcessWindowStation
GetUserObjectInformationW
gdi32
BitBlt
Sections
.text Size: - Virtual size: 358KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 133KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.LABS+[^ Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.LABS+[^ Size: - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp·@� Size: - Virtual size: 965KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp·@� Size: 512B - Virtual size: 508B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp·@� Size: 5.4MB - Virtual size: 5.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 136KB - Virtual size: 159KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ