Static task
static1
Behavioral task
behavioral1
Sample
ebc4cbf8f70ec573aebe700d61ef7e4ac1801cb5a2a7dfdf0db25f53c9c846ce.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
ebc4cbf8f70ec573aebe700d61ef7e4ac1801cb5a2a7dfdf0db25f53c9c846ce.exe
Resource
win10v2004-20240508-en
General
-
Target
ebc4cbf8f70ec573aebe700d61ef7e4ac1801cb5a2a7dfdf0db25f53c9c846ce
-
Size
6.6MB
-
MD5
1b466fa5ca3088a135f1e0e5b8ca56a0
-
SHA1
03dd1f59eacb9562ea245a4ff57a629fdf660781
-
SHA256
ebc4cbf8f70ec573aebe700d61ef7e4ac1801cb5a2a7dfdf0db25f53c9c846ce
-
SHA512
b74fca9e6cb78310f77dde6b8f44f0a903dd899e397578df3660c10cff9394f7224aa26f7d67ee3f84f356f333e20b6dae07ca674b27a1e7048f5f41b6b3891e
-
SSDEEP
98304:Rsu18VY8KhZkJs49njrIyX+Ymv3IwE+CLVDFdAU4c0nG:Rsu1GK4JNnQyX+YuIrhF4c0G
Malware Config
Signatures
Files
-
ebc4cbf8f70ec573aebe700d61ef7e4ac1801cb5a2a7dfdf0db25f53c9c846ce.exe windows:5 windows x86 arch:x86
1c7168ede70088c58d9daf6291efc796
Code Sign
77:a1:91:b0:4e:a1:ae:9e:4e:e8:2d:90:70:68:97:1fCertificate
IssuerCN=Kolomina Security Response Center,ST=Guangdong,C=China,1.2.840.113549.1.9.1=#0c134b6f6c6f6d696e61535243403132362e636f6dNot Before06/10/2022, 14:31Not After15/10/2023, 16:00SubjectCN=Kolomina Security Response Center,ST=Guangdong,C=China,1.2.840.113549.1.9.1=#0c134b6f6c6f6d696e61535243403132362e636f6d0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate
IssuerCN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before01/08/2022, 00:00Not After09/11/2031, 23:59SubjectCN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=USKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate
IssuerCN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before23/03/2022, 00:00Not After22/03/2037, 23:59SubjectCN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate
IssuerCN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=USNot Before21/09/2022, 00:00Not After21/11/2033, 23:59SubjectCN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
3c:57:47:b3:90:05:d8:6c:be:89:84:b1:53:e2:e9:19Certificate
IssuerCN=Kolomina Security Response Center,ST=Guangdong,C=China,1.2.840.113549.1.9.1=#0c134b6f6c6f6d696e61535243403132362e636f6dNot Before06/10/2022, 14:28Not After15/10/2023, 16:00SubjectCN=Kolomina Security Response Center,ST=Guangdong,C=China,1.2.840.113549.1.9.1=#0c134b6f6c6f6d696e61535243403132362e636f6d0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate
IssuerCN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=USNot Before21/09/2022, 00:00Not After21/11/2033, 23:59SubjectCN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate
IssuerCN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before23/03/2022, 00:00Not After22/03/2037, 23:59SubjectCN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate
IssuerCN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before01/08/2022, 00:00Not After09/11/2031, 23:59SubjectCN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=USKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
20:61:c5:db:be:d4:91:90:9f:ee:67:3f:36:22:15:9a:c2:72:00:35:70:db:14:f0:fe:cc:52:0c:28:90:d1:8bSigner
Actual PE Digest20:61:c5:db:be:d4:91:90:9f:ee:67:3f:36:22:15:9a:c2:72:00:35:70:db:14:f0:fe:cc:52:0c:28:90:d1:8bDigest Algorithmsha256PE Digest Matchestrue4e:0a:44:c8:4d:98:61:c1:08:84:da:b2:2f:97:37:82:3c:a8:16:53Signer
Actual PE Digest4e:0a:44:c8:4d:98:61:c1:08:84:da:b2:2f:97:37:82:3c:a8:16:53Digest Algorithmsha1PE Digest MatchestrueHeaders
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
GetVersion
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
UnregisterClassA
CharUpperBuffW
gdi32
ExtSelectClipRgn
winmm
waveOutPrepareHeader
winspool.drv
ClosePrinter
advapi32
RegCreateKeyExA
shell32
Shell_NotifyIconA
ole32
CLSIDFromString
oleaut32
VariantChangeType
comctl32
ord17
ws2_32
WSAAsyncSelect
comdlg32
GetFileTitleA
Exports
Exports
���6 �- �6d*%l�kQ�kB��*�*#�� fC|�-?���b��x^lx�I��� o���4��KD�iZ/��NJX';�4���ub��mt3�����g}�H�TZ���S:�i��F|u\���>���-L�Fj �'f �-�(j�3�x���^��7B8�<��u����$���vp<���.W7�f���@�{���Jjq�a��w����ʲ�� ���ֈ �}.Np7�Ȫ���� �i���� C���g� 7m��e�W�9k�4���F�|D˿���h2��E^qQ�����KYf�w�b@���7��q�_b�#��G�A�����v��Ɠ��&�ʮ���&w-�h�z�Y���#��y���9k����!2H%}�a'��w'8���l|uJs :�T���c��E�GyG4#ѺN<���~TA���W� ��R�{�t.���k��g`Fj{ȩ��^��z2�d�BJm�f�?;O+�BL����D*/�� e�e��O ��f L& ⵈ&T����OIs��E��-�d�D���3b�:E�b����v*nK�������ȑ��5{Sg�CZU1��M<��Y��C���Lm>@��)M�P[�� ����Fr��������oT�[t��z���^�bnM����~�������Uґ�k��y�R�r+z�]u����x���ˀ �������(�ĦԨWH�t.�������[1�3�tSb��R�S�`M�ܿfm�������Z-�V1RA K��NP���;}�#}��ނݤ������B��8�vpϢ�����%�L�?����6��S�e.��̒����dW�Ƙ7���m�Ӥ5� jjLS�5��Ch(�ո"Ob�wx�O��F�}�u3�k����+jWm���4V�R���~ �]�x���5���I%�&hWF���P��Ms|�� ���rÈ��2��i|�P6��.�m:��i�Ŏ�X��f%v��dJ)"bo����m���M�-ϢAW�E]6��?��L����p����żR�SE�WELF�������r���+��=�FC�w�IW�5�y�`�Z��g��8|�a�)l��.?H�qկP�HYT���w�a��ل� �PH=�V^)T+OUoH��fx28�Kn�5���T�ѓ��&���������ST9S�������s��s�.d�b�Q����)/�"��h�%����FOP������~L@`ʥv ڬo�k�i2'RY�M�'�-z:��Fi>T��=pU�ߚ�8�I��`�~��������7��y�U5OI�= ����rw~����P^���n̥w���5ػ��OX��N~�s ��fX�GG7�St� Zx��]�*(fǽo�����9�TV�OƇurSX�(!T�g|�+\�oJJ~�� E�e��u嬆��K�Y#�:V�o =;?��݃�|}��^1܇�3���q��sX��Di~H�U� +v�$����-]�ٯ���jb�(2�]ɨ�rn8�1�"$�����`oY�h�闕�C��^uPb𣰚v��T��:6I-5���h�&V�)��m|\��a01���sנ��Y���I��ۢ��@�ˈ���`K��f �_[%T�6��D�5�С��C�q�Hf�Bɟ�����r�}���9��#',X(�u��;y��/v�&�t�'·\��`�G!ӑ� ��vgC8C��pP!O��QR<Ĕ>�;XWv%�K�Q*���e��57#T�-���e�'h[[)"`堸\�}�f�C)\Y��r���Q��:�9�]�ö#tD!g��Ӳm8�}��G�������Cѫ@;�' �4<����k�� ��n����M&'�r�!�!L�K���B>V��h�f6�Ù�y*%� �]�H{��,��]�pz�%:Ld�_Cb_�����U�V�g Q9Y���X��~Q�C]�`�cE���:�H��C!�F�cV���9�u�=��ˎvDEڣuO�����v���N��F^XI��}�ZR����+�� ��d��(�T�SL辴,��^6�$ �/�X���7}9�����c��>O�3�=t�:O��]����sG���Ұl�]&�J#w�+�������0�{��p!7p�u�!mbفh=h]�=`�r��~�GM�,|g���l���g�����:j�B{�"�>Z��d�W��UC����g��xk��nʁ���q��=��"݀Xʌ\��5g�ij�w�2K�L���VeJ��[�6���qu��p���Y�?��H������J|eN����A�P��M%Dt�y�mBs�7dg�<9�f�����Ӏ^�&�$��G�*}�5�E7ҳ@ ��.OF?/|���ȑ!!��o���Z��I#�L�Ľ��Q��!�5���NX�&�_�����j6<�A�d�tC 9�[mzQ����y������%��3@o���#�=7䣁�L2��0|A��b�A�*�����@�/��R��U&=:!��D����=�l��Rt��5S��1�-���}���mM�a�0��->�U��g��U�ع���H���qoTğ�=Is�����H�hk4� �z�GT���$�3���yǓ*��������bZ�:$��Y˭:���F�Z�B�0�A������?�m/P�����O�� W[����u������|{y�>�6���I>|j��Jq��ָ�Qf̸�<<�Bk 1P�ҴI�N��|\j0���7.C�����>�Sj�|�{× H��p�ՈHF��K��J��e�Y1�S�X�X<�#� .� N��h������9;��p���D++��ޠ\+��sJU��h���l#/�����*��'s�W�#�������|��Z=V�߮���`������*x��n�03�0�5h�c�J�_�� ��פ�8�B3����At�W3����zz�ddq��g��m�Sz � eަ|wW,a���f�����܆A��Q���H�^��T�-��2͖����0��V���7f�����MV�/���m�[2|�q8��|Y���jڸ��X��̖ �ӂH#�9L|q]?%sI��O4�x��֡����g�ϰ�p���
Sections
.text Size: - Virtual size: 533KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
CODE Size: - Virtual size: 113KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 134KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DATA Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.w2v Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.t_- Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.:Z4 Size: 6.6MB - Virtual size: 6.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ