Static task
static1
Behavioral task
behavioral1
Sample
f473db9853e1af852d73f80f5a2c7e3e14060a856a9de15029a42ebfdac50831.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
f473db9853e1af852d73f80f5a2c7e3e14060a856a9de15029a42ebfdac50831.exe
Resource
win10v2004-en-20220113
General
-
Target
f473db9853e1af852d73f80f5a2c7e3e14060a856a9de15029a42ebfdac50831
-
Size
2.9MB
-
MD5
888d0a97e0d496efec74346ac8756848
-
SHA1
9029663a1ff39b5ddf31f35cdcf72196e1995fa1
-
SHA256
f473db9853e1af852d73f80f5a2c7e3e14060a856a9de15029a42ebfdac50831
-
SHA512
7d4ef820109c5a6876d228a4cbcd2f5088d1b271d9b11cfafffa74eaf9d0e65476276909c322a82dbcdc221e7f85dbb8da4365083a004630b7bcd8476dfc48e4
-
SSDEEP
49152:xNvm0T8TP8ZxMubGmNCSSGt9C/Vgm5qNPSnNl62hZYYuOvqeEXiemWWf+QNWYYOe:xNZ2AM3cRC/VgmKP+xYYuOyWfC
Malware Config
Signatures
-
Processes:
resource yara_rule sample themida
Files
-
f473db9853e1af852d73f80f5a2c7e3e14060a856a9de15029a42ebfdac50831.exe windows x86
Code Sign
32:9f:a5:f4:c4:c4:99:8f:4d:33:c6:ad:55:d8:68:c1Certificate
IssuerCN=Lenovo IdeaCentre 3 27IMB05 F0EY00G8KZNot Before31-10-2021 22:12Not After01-11-2031 22:12SubjectCN=Lenovo IdeaCentre 3 27IMB05 F0EY00G8KZ8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before23-10-2020 00:00Not After22-01-2032 23:59SubjectCN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02-05-2019 00:00Not After18-01-2038 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
6d:db:d0:e9:3f:bb:12:fd:50:3f:d7:da:fb:d0:bb:7a:24:42:3b:97:f4:bc:71:23:e4:7f:49:e9:0f:08:4e:25Signer
Actual PE Digest6d:db:d0:e9:3f:bb:12:fd:50:3f:d7:da:fb:d0:bb:7a:24:42:3b:97:f4:bc:71:23:e4:7f:49:e9:0f:08:4e:25Digest Algorithmsha256PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=Lenovo IdeaCentre 3 27IMB05 F0EY00G8KZ14-02-2022 17:36 Valid: false
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 100KB - Virtual size: 200KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 65KB - Virtual size: 339KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
r Qh((dv Size: 2KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 4.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
r Qh((dv Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 379KB - Virtual size: 378KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ