Static task
static1
Behavioral task
behavioral1
Sample
3016810dbad6bf95011053ac6d377e5634ee81dda4c6608ee7676ca24f7bc002.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
3016810dbad6bf95011053ac6d377e5634ee81dda4c6608ee7676ca24f7bc002.exe
Resource
win10v2004-en-20220113
General
-
Target
3016810dbad6bf95011053ac6d377e5634ee81dda4c6608ee7676ca24f7bc002
-
Size
3.4MB
-
MD5
9522e113ceb6fd6f55106987947fba83
-
SHA1
46e71af47218434b83268d289cf378dc925a2bf1
-
SHA256
3016810dbad6bf95011053ac6d377e5634ee81dda4c6608ee7676ca24f7bc002
-
SHA512
9325ff90f3311764157535965303beeb8b3722cfb9457f684c04157f529d730b0d9e3a5be70935dbbe6959c4e7ec494acb57d154912c3cf19ad3034a68c88a8c
-
SSDEEP
98304:H4G1ZL1lKFKy31I828DbYS9bZ+Ai/xk2VS7Dw/ZtKe4N:HZ7laK4I8LDbR9bZxBwni
Malware Config
Signatures
-
Processes:
resource yara_rule sample themida
Files
-
3016810dbad6bf95011053ac6d377e5634ee81dda4c6608ee7676ca24f7bc002.exe windows x86
Code Sign
20:9f:6c:a3:10:8e:01:91:4b:a5:87:1c:b6:19:1f:e8Certificate
IssuerCN=Lenovo IdeaCentre 3 27IMB05 F3EY00GNot Before03-11-2021 10:17Not After04-11-2031 10:17SubjectCN=Lenovo IdeaCentre 3 27IMB05 F3EY00G8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before23-10-2020 00:00Not After22-01-2032 23:59SubjectCN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02-05-2019 00:00Not After18-01-2038 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ce:c2:57:a5:9d:33:9b:e5:e9:ba:5b:83:19:fc:7f:5e:d8:61:1f:a3:89:ba:e8:e7:2a:46:27:08:05:2b:3d:0cSigner
Actual PE Digestce:c2:57:a5:9d:33:9b:e5:e9:ba:5b:83:19:fc:7f:5e:d8:61:1f:a3:89:ba:e8:e7:2a:46:27:08:05:2b:3d:0cDigest Algorithmsha256PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=Lenovo IdeaCentre 3 27IMB05 F3EY00G14-02-2022 18:11 Valid: false
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 100KB - Virtual size: 200KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 17KB - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
®°`~© Size: 2KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 4.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 2.9MB - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
®°`~© Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
®°`~© Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 383KB - Virtual size: 383KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ