Behavioral task
behavioral1
Sample
69f8a9ed6497c7e99fcdd02b919b3a3e.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
69f8a9ed6497c7e99fcdd02b919b3a3e.exe
Resource
win10v2004-20220721-en
General
-
Target
69f8a9ed6497c7e99fcdd02b919b3a3e.exe
-
Size
2.7MB
-
MD5
69f8a9ed6497c7e99fcdd02b919b3a3e
-
SHA1
3abf60e7c3a7c17e48ac1ea76082bef02347a825
-
SHA256
246fd02f7ed25c172ba3d9837c9a00c5983cb386ed0b96270cfffda94b34b911
-
SHA512
978c2711ec9c99fc2ea9e0bf93a0e99b8ef111c723f2217f94f1b8c787d096c5e7d5c2b5876a0b79d8f08b9d8d4ff30a40a7a0f6aa5f890c9c7562cfba7d6f07
-
SSDEEP
24576:+pZHoTZ/R3hnEcKsORdkCsGeKY8B2hFkR8wlX6CQhvD3uyqflPrmUVhhrcyRVHq7:+XU/RV+c+HsuFg31GaxRKGMuoE
Malware Config
Signatures
-
Processes:
resource yara_rule sample themida
Files
-
69f8a9ed6497c7e99fcdd02b919b3a3e.exe.exe windows x86
Code Sign
61:45:13:29:bf:9a:3c:8c:46:11:c7:13:ab:7d:85:47Certificate
IssuerCN=Jbl Słuchawki nauszne JBL Limited 900 BiałyNot Before06-07-2022 20:54Not After07-07-2032 20:54SubjectCN=Jbl Słuchawki nauszne JBL Limited 900 Biały90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before11-05-2022 00:00Not After10-08-2033 23:59SubjectCN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02-05-2019 00:00Not After18-01-2038 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
f0:03:85:56:5a:dd:8b:7d:c9:7a:20:87:ba:53:17:c5:3d:b6:42:e0:56:07:fe:d1:ce:dc:af:90:97:28:c3:5aSigner
Actual PE Digestf0:03:85:56:5a:dd:8b:7d:c9:7a:20:87:ba:53:17:c5:3d:b6:42:e0:56:07:fe:d1:ce:dc:af:90:97:28:c3:5aDigest Algorithmsha256PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=Jbl Słuchawki nauszne JBL Limited 900 Biały21-07-2022 15:16 Valid: false
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 55KB - Virtual size: 101KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 11KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 250KB - Virtual size: 250KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.themida Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE