Static task
static1
Behavioral task
behavioral1
Sample
9811d1327878652f0c843c3c7cf0185a71e19df337acf38c150be5413ef3c114.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
9811d1327878652f0c843c3c7cf0185a71e19df337acf38c150be5413ef3c114.exe
Resource
win10v2004-20240802-en
General
-
Target
9811d1327878652f0c843c3c7cf0185a71e19df337acf38c150be5413ef3c114.exe
-
Size
25.5MB
-
MD5
d649fefe245477f8ce4a5b6920dd6344
-
SHA1
3d8677b13eeb114318b929d4253844d22c5039a5
-
SHA256
9811d1327878652f0c843c3c7cf0185a71e19df337acf38c150be5413ef3c114
-
SHA512
c2fe4b04d11964a40f4225f53971dc42367efdc6e5f0b58ff7e67f19f12e59c35fdbb56f175a1c2433675be552fb3c643f4a54783d4503a06e90f6639247bc96
-
SSDEEP
393216:tHlhhT+tlixs3Ej9uMVQJ4ZPi4JlF7l0fVX/Ot4QBIv0i/1cogUZwX7oTzM:tHlhh6t+j9nQD4JnyVXNcidchKwXGzM
Malware Config
Signatures
Files
-
9811d1327878652f0c843c3c7cf0185a71e19df337acf38c150be5413ef3c114.exe.exe windows:6 windows x86 arch:x86
70027dbe413a462845e01aba26dbc296
Code Sign
49:2f:4c:59:c3:0d:a4:87:4e:96:19:1e:cc:70:70:c2Certificate
IssuerCN=_____________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!__________Not Before19-08-2024 09:49Not After20-08-2034 09:49SubjectCN=_____________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!_______________________________****_____!!!!!!!!!!!!!!!!!!!!!!!!!!__________3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89Certificate
IssuerCN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GBNot Before15-01-2024 00:00Not After14-04-2035 23:59SubjectCN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3fCertificate
IssuerCN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GBNot Before22-03-2021 00:00Not After21-03-2036 23:59SubjectCN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before22-03-2021 00:00Not After18-01-2038 23:59SubjectCN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
eb:42:83:06:e7:a4:11:64:7d:6d:7c:a9:c6:62:a8:c8:e2:c0:5c:c5:cc:0b:02:8a:b3:2c:ec:d2:94:e0:94:cbSigner
Actual PE Digesteb:42:83:06:e7:a4:11:64:7d:6d:7c:a9:c6:62:a8:c8:e2:c0:5c:c5:cc:0b:02:8a:b3:2c:ec:d2:94:e0:94:cbDigest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryW
GetProcAddress
ReadFile
WriteFile
lstrlenA
WaitForSingleObject
LocalAlloc
CreateFileW
MultiByteToWideChar
DeleteFileW
CloseHandle
ExitProcess
CreateProcessW
CopyFileW
WideCharToMultiByte
Sleep
GlobalFree
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress
shell32
SHGetFolderPathW
Sections
.text Size: - Virtual size: 25.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 47.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 100B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp**�� Size: - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp**�� Size: 512B - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp**�� Size: 25.5MB - Virtual size: 25.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 455KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ