Static task
static1
Behavioral task
behavioral1
Sample
6639540418063f3317b273d87be5fa90N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
6639540418063f3317b273d87be5fa90N.exe
Resource
win10v2004-20240802-en
General
-
Target
6639540418063f3317b273d87be5fa90N.exe
-
Size
204KB
-
MD5
6639540418063f3317b273d87be5fa90
-
SHA1
0b724a95359c4c88bfbeceb5222a940e26a87277
-
SHA256
4178834695d7a474e0f32c4460e6df08382b5db972bad15704453d0a3cd621e2
-
SHA512
bfda619f5bdf3183b3e5e87f07ac11927e43bedfc9a88f72fbee5f59fb88a327b5a50d7e723ced4c8aec1849bc81e22c2f6421dd2e3f8c3e3071961510485bb9
-
SSDEEP
6144:KVGdPRAFDiJuzdv4PSMBV+UdvrEFp7hK8xc:KV4PSBagdw6MBjvrEH7Zxc
Malware Config
Signatures
Files
-
6639540418063f3317b273d87be5fa90N.exe.exe windows:4 windows x86 arch:x86
b3557dffa6d810f6a9d28e0300f50338
Code Sign
4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3Certificate
IssuerOU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust NetworkNot Before12-05-1997 00:00Not After07-01-2004 23:59SubjectOU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9dCertificate
IssuerOU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust NetworkNot Before28-02-2001 00:00Not After06-01-2004 23:59SubjectCN=VeriSign Time Stamping Service,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)01,O=VeriSign\, Inc.Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate
IssuerCN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft CorporationNot Before10-01-1997 07:00Not After31-12-2020 07:00SubjectCN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation61:05:9b:e4:00:00:00:00:00:15Certificate
IssuerCN=Microsoft Windows Verification Intermediate PCA,OU=Copyright (c) 1999 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=WA,C=USNot Before30-06-2000 20:41Not After30-08-2001 20:51SubjectCN=Microsoft Windows 2000 Publisher (Europe),OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Dublin,C=IEExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
6a:0b:99:4f:c0:00:9d:aa:11:d3:30:a8:95:60:ac:faCertificate
IssuerCN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft CorporationNot Before01-07-1999 07:00Not After15-10-2005 07:00SubjectCN=Microsoft Windows Verification Intermediate PCA,OU=Copyright (c) 1999 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=WA,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign
Signer
Actual PE DigestDigest AlgorithmPE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateProcessA
GetExitCodeProcess
GetDriveTypeA
GetSystemDirectoryA
GetCurrentDirectoryA
CloseHandle
GetDiskFreeSpaceA
WaitForSingleObject
CreateEventA
GetFileAttributesA
GetCommandLineA
GetModuleFileNameA
GetProcessHeap
CreateFileA
SetFileTime
CreateThread
LocalFileTimeToFileTime
CreateDirectoryA
HeapAlloc
HeapFree
SetFilePointer
ReadFile
WriteFile
ExitProcess
GetLastError
RemoveDirectoryA
DeleteFileA
TerminateProcess
SetEvent
SetEnvironmentVariableA
GetEnvironmentVariableA
WideCharToMultiByte
DosDateTimeToFileTime
FormatMessageA
user32
EndDialog
SendDlgItemMessageA
LoadStringA
DialogBoxParamA
ShowWindow
SendMessageA
MessageBoxA
comctl32
ord17
shell32
SHBrowseForFolderA
SHGetPathFromIDListA
ntdll
strstr
_allmul
Sections
.text Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.zero Size: - Virtual size: 66KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 103KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ