Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220901-en
General
-
Target
file.exe
-
Size
1.8MB
-
MD5
3772a6815720d66f00b965905b070dde
-
SHA1
defc717b67fa8add118e577bce1d2a0da352cfa5
-
SHA256
ef25f0485a77e2a012eaeef4f0f5911fa655a5bf98f8e03e07e6b3e49cb16416
-
SHA512
120159e855276bef5589d7ed7f6caff0d611f799b2eaba0532f603b99ee250388322a0b4504bea73be68b226f9868723bb518b7a727fcec1241a2fda872c6d46
-
SSDEEP
49152:C6KjPbAh5mPL+3I0qS7G2K+St4pMYqJFxicuDy:kjP85hqS7G2K+9pubOe
Malware Config
Signatures
-
resource yara_rule sample themida
Files
-
file.exe.exe windows x64
Code Sign
71:64:ae:e2:75:ec:6f:9d:4d:d9:f4:14:3b:06:c6:0fCertificate
IssuerCN=Acer Nitro 5 AN517-52 [AN515-52-77M3]Not Before05/12/2022, 19:35Not After06/12/2032, 19:35SubjectCN=Acer Nitro 5 AN517-52 [AN515-52-77M3]90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before11/05/2022, 00:00Not After10/08/2033, 23:59SubjectCN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02/05/2019, 00:00Not After18/01/2038, 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
67:45:36:94:65:2f:6d:76:d8:9a:04:2f:e6:39:77:a4:58:8c:f0:97:b7:e5:e3:23:14:86:ea:7c:38:bc:c2:baSigner
Actual PE Digest67:45:36:94:65:2f:6d:76:d8:9a:04:2f:e6:39:77:a4:58:8c:f0:97:b7:e5:e3:23:14:86:ea:7c:38:bc:c2:baDigest Algorithmsha256PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=Acer Nitro 5 AN517-52 [AN515-52-77M3]15/12/2022, 13:57 Valid: false
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 478KB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 112KB - Virtual size: 111KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.themida Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ