Static task
static1
Behavioral task
behavioral1
Sample
233cb353b4dc5f127dd7863501875f5be44b96e299e29c3b6c30b1e984e2c918.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
233cb353b4dc5f127dd7863501875f5be44b96e299e29c3b6c30b1e984e2c918.exe
Resource
win10v2004-en-20220113
General
-
Target
233cb353b4dc5f127dd7863501875f5be44b96e299e29c3b6c30b1e984e2c918
-
Size
3.4MB
-
MD5
a6aebaf78d5d1d323dc4e7553424ecb3
-
SHA1
67443ca919e3f3811f50ba21321f3eda1d33909c
-
SHA256
233cb353b4dc5f127dd7863501875f5be44b96e299e29c3b6c30b1e984e2c918
-
SHA512
68dce0bbf2235ba83931898c13010f504009d2dbc8e00e780a59d7391af3fc8f0b7ce866fd5467a18094bb779fe7f6ca1be62d587e9bb2f3893fb05d742b6131
-
SSDEEP
98304:8CNygGJRRX92I2/LW6PYQhsd6D8GhZkvQafT:8gGTZ9iPZOUhZkYafT
Malware Config
Signatures
-
Processes:
resource yara_rule sample themida
Files
-
233cb353b4dc5f127dd7863501875f5be44b96e299e29c3b6c30b1e984e2c918.exe windows x86
Code Sign
28:53:5f:02:5d:bb:fe:9b:43:cf:f7:3f:f3:0d:28:f9Certificate
IssuerCN=Asus SDRW-09D2S-MEXNot Before17-11-2021 11:48Not After18-11-2031 11:48SubjectCN=Asus SDRW-09D2S-MEX8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before23-10-2020 00:00Not After22-01-2032 23:59SubjectCN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02-05-2019 00:00Not After18-01-2038 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
be:da:69:b6:ba:db:fa:c5:a3:78:b4:97:53:5c:32:c9:76:8a:ea:7e:d2:ea:82:98:2f:9f:78:19:fa:db:92:47Signer
Actual PE Digestbe:da:69:b6:ba:db:fa:c5:a3:78:b4:97:53:5c:32:c9:76:8a:ea:7e:d2:ea:82:98:2f:9f:78:19:fa:db:92:47Digest Algorithmsha256PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=Asus SDRW-09D2S-MEX14-02-2022 17:39 Valid: false
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 91KB - Virtual size: 192KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 8KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
® < � Size: 3KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 5.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
® < � Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 253KB - Virtual size: 252KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ