Static task
static1
Behavioral task
behavioral1
Sample
be630b379514bcea2ea2bb6285c966812b818b49c345ff5ce2ee2e714543f5dd.exe
Resource
win7-20240419-en
General
-
Target
661c97c107efc1d69510c2c4ea7aad09.bin
-
Size
3.8MB
-
MD5
1e39c73e52db3178c7282bc04162829c
-
SHA1
ee46b43ba2170b4be77cf794123a65b59f9ae20d
-
SHA256
56523ebe0f44f992e7a99e5b3f499ce215d2bf5d798a20df964f91361991f60b
-
SHA512
8d6d4dcbe0176037b4d8a03b61a9f23a832a44611be1e9ff5d99b5ecaf905295fd99551ba877099911adf1c2b9469f33ba9f271d1b003d69c16710029e6eef16
-
SSDEEP
98304:JK3Hgk9H1xULIF+BrXNZUoFvcHtaFCF8xKXUBkxVOl4yN:688F+xXNZU2C6xga0m
Malware Config
Signatures
Files
-
661c97c107efc1d69510c2c4ea7aad09.bin.zip
Password: infected
-
be630b379514bcea2ea2bb6285c966812b818b49c345ff5ce2ee2e714543f5dd.exe.exe windows:6 windows x86 arch:x86
Password: infected
fce2185f86316405847dae4f4adccdc7
Code Sign
59:ae:12:33:e1:80:68:97:43:8d:f0:ee:c7:05:1e:17Certificate
IssuerCN=AVG Technologies USA LLC ™‰™‰™‰Not Before06-01-2024 10:14Not After07-01-2034 10:14SubjectCN=AVG Technologies USA LLC ™‰™‰™‰39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before03-05-2023 00:00Not After02-08-2034 23:59SubjectCN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02-05-2019 00:00Not After18-01-2038 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
a4:fc:bb:e9:96:67:2b:45:b9:b2:94:92:89:4c:e2:98:af:98:fb:dd:88:9a:d9:40:70:04:f1:53:89:1a:ff:41Signer
Actual PE Digesta4:fc:bb:e9:96:67:2b:45:b9:b2:94:92:89:4c:e2:98:af:98:fb:dd:88:9a:d9:40:70:04:f1:53:89:1a:ff:41Digest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress
user32
wsprintfA
gdi32
CreateCompatibleBitmap
advapi32
RegQueryValueExA
shell32
ShellExecuteA
ole32
CoInitialize
ws2_32
WSAStartup
crypt32
CryptUnprotectData
shlwapi
PathFindExtensionA
gdiplus
GdipGetImageEncoders
setupapi
SetupDiEnumDeviceInfo
ntdll
RtlUnicodeStringToAnsiString
rstrtmgr
RmStartSession
Sections
.text Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 158KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp¼® Size: - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp¼® Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp¼® Size: 3.8MB - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 120KB - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ