Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7-20220901-en
General
-
Target
eb.7z
-
Size
3.0MB
-
MD5
189324f227cbf8749e84684ed7624ad4
-
SHA1
df6daa19f3c410237ed4fcb12305b0cfd2b3c90b
-
SHA256
42aa9d720fd480bd1ed12a82dc506ba98a549eaeafd12a85669ac3beff8ae883
-
SHA512
44fd0b4967aa5a0d0224c01b48406b9b552458fc49cf5251e94b69812a47cfee65302f3092f1005937eb82f29d52c1dc7eb28c46ad76c9590c6b691855606357
-
SSDEEP
98304:bDY8yYiAodK8X6dY+0osYVdBpjBYLf12HvEGYCFxVEh:bDViAoZqdyo1VdFYz12PpfVEh
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Setup.exe themida
Files
-
eb.7z.7z
Password: infected
-
Setup.exe.exe windows x86
Code Sign
61:35:d0:1a:8e:b2:e5:ab:46:6a:c6:7a:75:bd:f1:29Certificate
IssuerCN=Toshiba MQ01ABDxx 2.5 MQ01ABD060Not Before07/10/2022, 12:21Not After08/10/2032, 12:21SubjectCN=Toshiba MQ01ABDxx 2.5 MQ01ABD06090:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before11/05/2022, 00:00Not After10/08/2033, 23:59SubjectCN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02/05/2019, 00:00Not After18/01/2038, 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
de:7e:17:20:55:7b:bc:ea:65:97:82:e1:59:43:18:2d:4f:f9:a1:c9:39:f3:a8:78:6a:4c:b1:b8:0c:99:d0:18Signer
Actual PE Digestde:7e:17:20:55:7b:bc:ea:65:97:82:e1:59:43:18:2d:4f:f9:a1:c9:39:f3:a8:78:6a:4c:b1:b8:0c:99:d0:18Digest Algorithmsha256PE Digest MatchesfalseSignature Validations
TrustedfalseVerification
Signing CertificateCN=Toshiba MQ01ABDxx 2.5 MQ01ABD06006/10/2022, 18:34 Valid: false
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 600B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 71KB - Virtual size: 162KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 266KB - Virtual size: 388KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 36B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 200KB - Virtual size: 200KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 5.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ