Static task
static1
Behavioral task
behavioral1
Sample
466ed8bcdb6d7466660f628d32c9326602e9c20e271cabb32dbd265f27f3dad1.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
466ed8bcdb6d7466660f628d32c9326602e9c20e271cabb32dbd265f27f3dad1.exe
Resource
win10v2004-20220414-en
General
-
Target
466ed8bcdb6d7466660f628d32c9326602e9c20e271cabb32dbd265f27f3dad1
-
Size
2.4MB
-
MD5
dfc65d1cd13a921a501ea6e563ec7310
-
SHA1
ed65326c9181b4d51b9bea9daf0925d5dc6b0bc2
-
SHA256
466ed8bcdb6d7466660f628d32c9326602e9c20e271cabb32dbd265f27f3dad1
-
SHA512
58781636aa44410d7368fe3845c639c7dc47d48a672af487f28ca05d07e39cc143c5662dad9b746bfd44392c751dffeef154ca81fb33985a9a034315762521f3
-
SSDEEP
49152:rK1SOZff1QkOYYBQBHVModCGMuxXbI0DWcj88vj06DCLx000E4NsQ:r/4ffyyAQ5GwxXN588Ex000E4NsQ
Malware Config
Signatures
-
Processes:
resource yara_rule sample themida
Files
-
466ed8bcdb6d7466660f628d32c9326602e9c20e271cabb32dbd265f27f3dad1.exe windows x86
Code Sign
67:57:59:34:e5:a3:6b:81:4c:f4:c2:58:2b:e5:e2:31Certificate
IssuerCN=Gigabyte BRIX ComeLake-Z BRi91H-11770Not Before15-10-2021 11:50Not After16-10-2031 11:50SubjectCN=Gigabyte BRIX ComeLake-Z BRi91H-117708c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before23-10-2020 00:00Not After22-01-2032 23:59SubjectCN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02-05-2019 00:00Not After18-01-2038 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
f6:1b:c2:ae:42:dd:1c:48:90:c7:45:1d:ee:01:67:f5:38:1c:21:bd:b1:1c:9e:88:f9:ac:62:2a:41:f4:90:71Signer
Actual PE Digestf6:1b:c2:ae:42:dd:1c:48:90:c7:45:1d:ee:01:67:f5:38:1c:21:bd:b1:1c:9e:88:f9:ac:62:2a:41:f4:90:71Digest Algorithmsha256PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=Gigabyte BRIX ComeLake-Z BRi91H-1177030-06-2022 15:34 Valid: false
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 102KB - Virtual size: 224KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 4KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-wyC9%ts Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 3.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
-wyC9%ts Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
-wyC9%ts Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
-wyC9%ts Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
-wyC9%ts Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
-wyC9%ts Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
-wyC9%ts Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
-wyC9%ts Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
-wyC9%ts Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
-wyC9%ts Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
-wyC9%ts Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
-wyC9%ts Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 284KB - Virtual size: 283KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ