Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220901-en
General
-
Target
file.exe
-
Size
2.9MB
-
MD5
1e46438f13693aaa0f35a0c796d60c61
-
SHA1
a4cfbb31c87c7368554a5081157382bedded6551
-
SHA256
97df47266aba1d8e7c70c88c8bf0851a53579dfac7d2bb6545ca85e809bbf1c6
-
SHA512
b0348e5f8962261a64130208c86321afebaff4fe1b1cb2b164a8bc35dca73ecfaaf7d2348865bee88233f3feeff3deb2884f23e86c66ee88270f55c6252c4778
-
SSDEEP
49152:zgVPqtIzOYelWFO5zKLV/28K6gCCLP8FL5A3mACFkHtNX6GB4I7pvIOSA:z4PSInelcYwVVK677DkHLXlB4CIPA
Malware Config
Signatures
-
Processes:
resource yara_rule sample themida
Files
-
file.exe.exe windows x64
Code Sign
44:b2:87:48:08:c1:31:a2:4f:9a:a0:f8:d6:fa:78:f0Certificate
IssuerCN=Colorful iGame Z390-X RNG Edition V40Not Before27-11-2022 22:00Not After28-11-2032 22:00SubjectCN=Colorful iGame Z390-X RNG Edition V4090:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before11-05-2022 00:00Not After10-08-2033 23:59SubjectCN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02-05-2019 00:00Not After18-01-2038 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
7b:73:e3:f7:f8:06:61:8a:cb:7d:bd:79:af:b4:5f:38:1d:47:ba:1c:68:b8:8d:dd:85:6f:f7:7a:7b:fa:2f:4fSigner
Actual PE Digest7b:73:e3:f7:f8:06:61:8a:cb:7d:bd:79:af:b4:5f:38:1d:47:ba:1c:68:b8:8d:dd:85:6f:f7:7a:7b:fa:2f:4fDigest Algorithmsha256PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=Colorful iGame Z390-X RNG Edition V4001-12-2022 14:34 Valid: false
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 300KB - Virtual size: 424KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.themida Size: - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 2.6MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ