Static task
static1
Behavioral task
behavioral1
Sample
e2f7bcd1daac067dbf331d25be08b63d9577cb4246e7f8ee39181d91420a2a52.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
e2f7bcd1daac067dbf331d25be08b63d9577cb4246e7f8ee39181d91420a2a52.exe
Resource
win10v2004-en-20220112
General
-
Target
e2f7bcd1daac067dbf331d25be08b63d9577cb4246e7f8ee39181d91420a2a52
-
Size
2.7MB
-
MD5
3059f6b1e936e93c7d7a2e3ca9d8bc10
-
SHA1
7842de9af38f52b75b990a1490dc6e8e7d4045a8
-
SHA256
e2f7bcd1daac067dbf331d25be08b63d9577cb4246e7f8ee39181d91420a2a52
-
SHA512
94e68d80113b830911b9ec5dc4bc2485cfcf87d103d20276c122a22a1c77b1b11d7be328a5e4cf50a3c2cea4088cc8041b8e28b0c6f2f192b846ce09f991c6ad
-
SSDEEP
49152:iO8GC8zXTTDP2VxehzveEhI88NsGeVFnz0JZ3Hi2Ss9ce9y+QDWYYOu4S:a38zza2reEhF8zkzEZ3HibsaeEY
Malware Config
Signatures
-
Processes:
resource yara_rule sample themida
Files
-
e2f7bcd1daac067dbf331d25be08b63d9577cb4246e7f8ee39181d91420a2a52.exe windows x86
Code Sign
3f:47:01:9a:a6:ed:91:8b:42:16:b5:e2:63:cd:d0:cdCertificate
IssuerCN=Lenovo IdeaCentre 4 219IMB04 NW3EY13GNot Before09-11-2021 22:23Not After10-11-2031 22:23SubjectCN=Lenovo IdeaCentre 4 219IMB04 NW3EY13G8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before23-10-2020 00:00Not After22-01-2032 23:59SubjectCN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02-05-2019 00:00Not After18-01-2038 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
37:a7:eb:50:14:ea:ad:ca:98:7a:42:c2:f9:78:32:4c:a4:75:85:ba:ed:10:a1:df:cc:ae:df:e3:de:90:95:23Signer
Actual PE Digest37:a7:eb:50:14:ea:ad:ca:98:7a:42:c2:f9:78:32:4c:a4:75:85:ba:ed:10:a1:df:cc:ae:df:e3:de:90:95:23Digest Algorithmsha256PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=Lenovo IdeaCentre 4 219IMB04 NW3EY13G14-02-2022 17:36 Valid: false
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 100KB - Virtual size: 200KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 65KB - Virtual size: 339KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
®°`~© Size: 2KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 3.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
®°`~© Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
®°`~© Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 333KB - Virtual size: 333KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ