Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
General
-
Target
file.exe
-
Size
3.2MB
-
MD5
21c4865673cc339ddd94dcc917c575ee
-
SHA1
036194acd32f8e65c5077e89336ee596075484e2
-
SHA256
1a12d9c9ac19873abafa62c6d37eb8c31495a0818e8aa99987b41126cd31cd02
-
SHA512
10aab10d3dca2611cc3c2b719aa5d50c46992147f126fa2e20843b2f82620052a98f56e999675e793d6de0be505a5d79e7746dacabeb56fce46b62657be4683b
-
SSDEEP
49152:s6U1gC9btl/jP+C+CmGFhtsN7fTROWBtKqycrCqH4fHrrh4cw:S9xl7P+CnmGFhtubt0JqSHZ4cw
Malware Config
Signatures
-
resource yara_rule sample themida
Files
-
file.exe.exe windows x86
Code Sign
1f:8b:76:a0:0f:27:09:b4:40:0d:47:f2:ab:6c:52:efCertificate
IssuerCN=Toshiba MQ01ABMxx 2.5 MQ01ABW070Not Before09/10/2022, 12:10Not After10/10/2032, 12:10SubjectCN=Toshiba MQ01ABMxx 2.5 MQ01ABW07090:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before11/05/2022, 00:00Not After10/08/2033, 23:59SubjectCN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02/05/2019, 00:00Not After18/01/2038, 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
10:17:d1:49:23:41:9b:82:66:b5:a9:37:67:55:37:73:4e:6c:b7:66:66:26:89:62:01:55:ce:8c:1f:3d:4d:d5Signer
Actual PE Digest10:17:d1:49:23:41:9b:82:66:b5:a9:37:67:55:37:73:4e:6c:b7:66:66:26:89:62:01:55:ce:8c:1f:3d:4d:d5Digest Algorithmsha256PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=Toshiba MQ01ABMxx 2.5 MQ01ABW07006/10/2022, 18:35 Valid: false
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 105KB - Virtual size: 237KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 25KB - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 2KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 9KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Size: 303KB - Virtual size: 510KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE