Static task
static1
Behavioral task
behavioral1
Sample
8a6b873c33a29deec0577850aad8b145b7f3b8f2f1d417f70c863d47e0c74ddeN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
8a6b873c33a29deec0577850aad8b145b7f3b8f2f1d417f70c863d47e0c74ddeN.exe
Resource
win10v2004-20240802-en
General
-
Target
8a6b873c33a29deec0577850aad8b145b7f3b8f2f1d417f70c863d47e0c74ddeN
-
Size
204KB
-
MD5
fafdbdb1608a124973ac4c835379eb80
-
SHA1
8220e39c6606a1a0ddb0f5a3b4c77278d1121fe6
-
SHA256
8a6b873c33a29deec0577850aad8b145b7f3b8f2f1d417f70c863d47e0c74dde
-
SHA512
1c90f5d345987d6ed9d478f91b3faaec820e96a230fa3c14ac0f46e44dc3306bf36000da967416c6e2c09e27b08808d85465230861b1ad581a71d070942513e6
-
SSDEEP
3072:XO/6nl92ILkt6i2ox7c39b1a0J86W8xXCKNWOHU/ezYMVWtG4SPUkxbgl:XgFtboVBJtNWyPnYG4fUbk
Malware Config
Signatures
Files
-
8a6b873c33a29deec0577850aad8b145b7f3b8f2f1d417f70c863d47e0c74ddeN.exe windows:4 windows x86 arch:x86
430af33f4ce9475c62e2d9321d894f4c
Code Sign
70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bfCertificate
IssuerOU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=USNot Before29-01-1996 00:00Not After01-08-2028 23:59SubjectOU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before15-06-2007 00:00Not After14-06-2012 23:59SubjectCN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04-12-2003 00:00Not After03-12-2013 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
1c:2d:d6:1a:35:e6:5d:f6:29:97:01:ff:9b:e5:ca:44Certificate
IssuerCN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=USNot Before20-01-2010 00:00Not After24-01-2012 23:59SubjectCN=BITDEFENDER LLC,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=BITDEFENDER LLC,L=Fort Lauderdale,ST=Florida,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate
IssuerOU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=USNot Before21-05-2009 00:00Not After20-05-2019 23:59SubjectCN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
48:3b:2d:69:dd:6e:5b:38:98:ea:c2:92:e8:77:dd:8b:21:8f:b0:0eSigner
Actual PE Digest48:3b:2d:69:dd:6e:5b:38:98:ea:c2:92:e8:77:dd:8b:21:8f:b0:0eDigest Algorithmsha1PE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
OpenMutexW
LocalAlloc
lstrcatW
FindAtomW
GetAtomNameA
GetCurrentThread
InitializeCriticalSection
CompareStringA
WinExec
lstrcpy
GetComputerNameA
GetExpandedNameA
FileTimeToDosDateTime
GetAtomNameW
SetUnhandledExceptionFilter
GetLongPathNameA
DuplicateHandle
SetLastError
SetThreadPriority
GlobalGetAtomNameW
SearchPathA
IsBadCodePtr
CreateNamedPipeA
GetStartupInfoW
GetTempPathA
GetLogicalDrives
FindAtomA
GetSystemDefaultLCID
GetProcAddress
GetModuleHandleA
FindResourceA
GetTimeFormatW
GetHandleInformation
EndUpdateResourceA
GetProcessHeap
CreateMailslotW
GetThreadLocale
GetExpandedNameW
SetCalendarInfoA
GetCurrentDirectoryA
OpenEventA
GetLogicalDriveStringsA
lstrcmp
ExitThread
GetVersionExW
CreateSemaphoreA
user32
GetDCEx
LoadCursorA
CreatePopupMenu
GetCapture
CreateCaret
LoadBitmapW
TrackPopupMenu
DefFrameProcW
GetAsyncKeyState
CharUpperA
CreateDesktopW
CreateAcceleratorTableW
MessageBoxIndirectW
SetCursorPos
InsertMenuW
DeleteMenu
InvalidateRgn
mouse_event
ActivateKeyboardLayout
PeekMessageA
ReleaseDC
CopyIcon
CharUpperW
MonitorFromWindow
LoadMenuIndirectA
CreateWindowExA
GetMenuItemInfoW
LoadCursorW
CopyImage
IsChild
MoveWindow
CharLowerW
EndDialog
DefDlgProcW
GetActiveWindow
DestroyWindow
CheckMenuRadioItem
SetCursor
MonitorFromRect
CreateDialogIndirectParamW
EnableMenuItem
SetDlgItemTextW
UpdateWindow
LoadIconA
ArrangeIconicWindows
SendMessageW
EmptyClipboard
GetMessageA
SetWindowPos
gdi32
RemoveFontResourceExW
SetPaletteEntries
EnumObjects
StrokeAndFillPath
GetEnhMetaFileHeader
RestoreDC
CreateMetaFileW
Polygon
GetBkMode
SetLayout
TranslateCharsetInfo
PolyBezierTo
advapi32
RegCreateKeyExA
RegCreateKeyW
RegReplaceKeyW
comdlg32
ReplaceTextA
FindTextW
FindTextA
oleaut32
VarBoolFromDisp
GetRecordInfoFromGuids
LoadTypeLib
version
VerInstallFileW
GetFileVersionInfoSizeA
urlmon
ReleaseBindInfo
BindAsyncMoniker
HlinkGoForward
CDLGetLongPathNameW
URLDownloadA
CompareSecurityIds
IsAsyncMoniker
URLOpenPullStreamA
URLOpenStreamW
RegisterFormatEnumerator
winmm
mmTaskCreate
midiInGetID
NotifyCallbackData
midiOutMessage
inetcomm
MimeOleSMimeCapsToDlg
MimeOleSetBodyPropA
MimeOleSetDefaultCharset
DllGetClassObject
oledlg
OleUIChangeSourceA
OleUIAddVerbMenuA
OleUIInsertObjectW
OleUIPasteSpecialA
Sections
.text Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.MBqyqw Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Xp Size: 1KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.iVZWys Size: 2KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.av Size: 4KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.TD Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CXg Size: 512B - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.J Size: 1KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.CDN Size: 512B - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.X Size: 512B - Virtual size: 118KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 162KB - Virtual size: 161KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ