General
-
Target
240ff64b312acf203a1498a58801bf79ad99617e7dbf961c6a289531d1b7b39b
-
Size
1.5MB
-
MD5
e66dec71ef0ffbb33127f41b8ab1fe3e
-
SHA1
719e12ef09b6e3ab747421946a57739a649cf483
-
SHA256
240ff64b312acf203a1498a58801bf79ad99617e7dbf961c6a289531d1b7b39b
-
SHA512
1ba9a2f4bc6552339078762acd52b59d2ed3798d49b6b5bf0615f3caa6a315103f3166e8941b94f6d5a01e06dfdd38363e1e6d1091fe046e1697589e57a79959
-
SSDEEP
24576:7UA0Aa/NF9BpvbxxQO/Wh5ChSNF3PWjdCXpKO7Yq8EMHOS8NdOBG7QTOTzgZrkQ3:10xlbBpvHb/Wh5Xv3OjdKKOj8ErRNdu1
Malware Config
Signatures
-
Processes:
resource yara_rule sample themida
Files
-
240ff64b312acf203a1498a58801bf79ad99617e7dbf961c6a289531d1b7b39b.dll windows x64
Code Sign
1f:b8:fb:34:1b:ad:b8:8a:42:98:d8:3e:97:c5:85:21Certificate
IssuerCN=SSD Western Digital Blue SA510 1 ТБ SATA (WDS100T3B0A)Not Before28-05-2023 12:56Not After29-05-2033 12:56SubjectCN=SSD Western Digital Blue SA510 1 ТБ SATA (WDS100T3B0A)39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before03-05-2023 00:00Not After02-08-2034 23:59SubjectCN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02-05-2019 00:00Not After18-01-2038 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
b2:ff:d9:28:86:32:15:60:7c:a2:6a:7f:7a:b3:b7:d7:86:2f:13:48:80:7f:f6:05:74:3a:5b:da:4b:9e:91:26Signer
Actual PE Digestb2:ff:d9:28:86:32:15:60:7c:a2:6a:7f:7a:b3:b7:d7:86:2f:13:48:80:7f:f6:05:74:3a:5b:da:4b:9e:91:26Digest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
rundll
Sections
Size: 4KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 595B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 432B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.themida Size: - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ