Behavioral task
behavioral1
Sample
38fdcea1a60613c5e0ac45985312b01e34f1b39b6c86caa99c19e3bd971a2c59.exe
Resource
win7-20220715-en
General
-
Target
38fdcea1a60613c5e0ac45985312b01e34f1b39b6c86caa99c19e3bd971a2c59
-
Size
4.1MB
-
MD5
35239580e14f6a36f65cdd1d38c6173d
-
SHA1
dc979f23b12c5665ae3d75559c749c198e86eb89
-
SHA256
38fdcea1a60613c5e0ac45985312b01e34f1b39b6c86caa99c19e3bd971a2c59
-
SHA512
ca9c74f2dc6b21cbadde6173f3d92ea4620e92942121af8b01b264ab32a5e2bbac2396f6b83aeb28e9c6fb8dbc80d5f95b429549320c74e51596c9fe94d207f2
-
SSDEEP
98304:7iuUiURQfOpCZ5y2XtM7I8cNd/jiZNRDbu94oD3JYLPFrAQhL:7ip8fHu29M75XRDbYjJi6gL
Malware Config
Signatures
-
Processes:
resource yara_rule sample themida
Files
-
38fdcea1a60613c5e0ac45985312b01e34f1b39b6c86caa99c19e3bd971a2c59.exe windows x86
Code Sign
71:af:88:3c:a5:c1:f6:a5:46:8e:1d:00:0e:8f:62:a0Certificate
IssuerCN=Sony SEL-55210` 55-210mm F4.5-6.3Not Before04-08-2022 17:15Not After05-08-2032 17:15SubjectCN=Sony SEL-55210` 55-210mm F4.5-6.390:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before11-05-2022 00:00Not After10-08-2033 23:59SubjectCN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02-05-2019 00:00Not After18-01-2038 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ab:10:27:17:52:cb:28:79:ee:ef:c8:71:c6:5e:93:a8:01:fb:76:1c:9f:4a:a8:aa:dd:a5:ec:e4:52:57:01:b7Signer
Actual PE Digestab:10:27:17:52:cb:28:79:ee:ef:c8:71:c6:5e:93:a8:01:fb:76:1c:9f:4a:a8:aa:dd:a5:ec:e4:52:57:01:b7Digest Algorithmsha256PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=Sony SEL-55210` 55-210mm F4.5-6.305-08-2022 12:34 Valid: false
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 714KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 430KB - Virtual size: 625KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.vm_sec Size: 240KB - Virtual size: 240KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 33KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ