Static task
static1
Behavioral task
behavioral1
Sample
323053004bc09e79c9679121caeb0c5b83c98918922c38a8f585102f60d34655.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
323053004bc09e79c9679121caeb0c5b83c98918922c38a8f585102f60d34655.exe
Resource
win10v2004-en-20220113
General
-
Target
323053004bc09e79c9679121caeb0c5b83c98918922c38a8f585102f60d34655
-
Size
2.7MB
-
MD5
6199c715751419cc9b62e8682b45cc53
-
SHA1
0b56648ffcfbb582fb5f8d76359277b34536d8ba
-
SHA256
323053004bc09e79c9679121caeb0c5b83c98918922c38a8f585102f60d34655
-
SHA512
c94e3be8a1a1034c9a7c9bef38a9d0a0e82d901dc406c1f0d7a900ea8f6ae667d4bca654f4b2536bb47e15785d37ce48b0537748dea42e6544dd5eb4ee3c514d
-
SSDEEP
49152:4fXKHa9+oIXEHQSwAiv5bd4eziBI7ohBcFDey2lbUl0y8pUMD7tQ1j4O1WYYOu49:KvwvXEHQQj74xcUB8ptQp4OX
Malware Config
Signatures
-
Processes:
resource yara_rule sample themida
Files
-
323053004bc09e79c9679121caeb0c5b83c98918922c38a8f585102f60d34655.exe windows x86
Code Sign
1e:0a:fd:ec:eb:dd:4b:bd:40:68:bf:10:fc:ed:63:faCertificate
IssuerCN=Asus SDRW-09D2S-U LITENot Before12-11-2021 10:29Not After13-11-2031 10:29SubjectCN=Asus SDRW-09D2S-U LITE8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before23-10-2020 00:00Not After22-01-2032 23:59SubjectCN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02-05-2019 00:00Not After18-01-2038 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
3b:10:d0:c8:be:3e:c4:e1:26:5a:85:3b:82:b6:85:d4:cb:91:c9:ce:41:f7:99:2c:ab:fb:18:98:ff:14:a2:29Signer
Actual PE Digest3b:10:d0:c8:be:3e:c4:e1:26:5a:85:3b:82:b6:85:d4:cb:91:c9:ce:41:f7:99:2c:ab:fb:18:98:ff:14:a2:29Digest Algorithmsha256PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=Asus SDRW-09D2S-U LITE14-02-2022 17:36 Valid: false
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 101KB - Virtual size: 200KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 102KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
°`~©\6 Size: 2KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 4.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
°`~©\6 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
°`~©\6 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 108KB - Virtual size: 107KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ