Behavioral task
behavioral1
Sample
EFB17623F04C4018000E57DA2874F594.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
EFB17623F04C4018000E57DA2874F594.exe
Resource
win10v2004-20220721-en
General
-
Target
EFB17623F04C4018000E57DA2874F594.fil
-
Size
5.8MB
-
MD5
efb17623f04c4018000e57da2874f594
-
SHA1
5061791d84c91e9a8e818e351729f3bf780eb7ef
-
SHA256
64d8cc20d5a9f8fbcf68f2b2242ac8346a82e6b72015cc0633bbad2833712036
-
SHA512
7abe0bb16320df8347901cf6333b1f2c23af047e22a942a2f9f9957e25f6a1d346d3b1beaa9cafde2f6e089eed35b0e72fc82f15ba97307154c2890623d102e1
-
SSDEEP
98304:Xv5o06VuYVly5tCsW7gy2qXkI5JmmPrGab5lUKb3vMlFGDvKnRe5Sn52xu:WVw5TzAr1jb5uAMlmKR4xu
Malware Config
Signatures
-
Processes:
resource yara_rule sample themida
Files
-
EFB17623F04C4018000E57DA2874F594.fil.exe windows x86
acc80ba52ab9d4d853acd299dd40c67b
Code Sign
7b:9d:aa:39:b4:4c:b9:b3:4d:ce:0f:b3:95:ce:87:acCertificate
IssuerCN=JBL Słuchawki nauszne JBL Limited 899 ComboNot Before25-07-2022 13:47Not After26-07-2032 13:47SubjectCN=JBL Słuchawki nauszne JBL Limited 899 Combo90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before11-05-2022 00:00Not After10-08-2033 23:59SubjectCN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02-05-2019 00:00Not After18-01-2038 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
df:65:25:ac:85:9a:30:ae:1f:1d:e1:ef:25:a9:c6:bc:bd:dd:8c:80:f2:5b:ed:0c:39:26:76:17:8a:17:92:f3Signer
Actual PE Digestdf:65:25:ac:85:9a:30:ae:1f:1d:e1:ef:25:a9:c6:bc:bd:dd:8c:80:f2:5b:ed:0c:39:26:76:17:8a:17:92:f3Digest Algorithmsha256PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=JBL Słuchawki nauszne JBL Limited 899 Combo25-07-2022 12:18 Valid: false
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleA
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ShowWindow
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
Sections
Size: 51KB - Virtual size: 101KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 8KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
וועכ Size: 633KB - Virtual size: 632KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vm_sec Size: 160KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.themida Size: - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
וועכ Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
וועכ Size: 512B - Virtual size: 452B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
וועכ Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 633KB - Virtual size: 632KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ