Behavioral task
behavioral1
Sample
b70e9b8c5403fc3f344e395929443f8a778fcf7f13e2d636f639bc2f96f77eea.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
b70e9b8c5403fc3f344e395929443f8a778fcf7f13e2d636f639bc2f96f77eea.exe
Resource
win10-20230621-en
General
-
Target
b70e9b8c5403fc3f344e395929443f8a778fcf7f13e2d636f639bc2f96f77eea
-
Size
2.9MB
-
MD5
9330704596f124317194dc276e4a6774
-
SHA1
cf3f558571cc96c733e2d155ec3920b1ea7bc27f
-
SHA256
b70e9b8c5403fc3f344e395929443f8a778fcf7f13e2d636f639bc2f96f77eea
-
SHA512
4ddb0f07344ee7cb8ae42c04a82f803179a5d8f9ea0853931040fa670bd609ebe4f82693390677d01fda2f258844f14c6916a43f29023bdcac4b5245008474bf
-
SSDEEP
49152:qkHD79N8If0rOQf9cD7v4LUdlJazpiTYW1j3kM6Z2coOPK+Y1zZ4S4GYruu:qG74DR1M4UdlgtEYWp3x6ZfbVUzOfruu
Malware Config
Signatures
-
resource yara_rule sample themida
Files
-
b70e9b8c5403fc3f344e395929443f8a778fcf7f13e2d636f639bc2f96f77eea.exe windows x86
Code Sign
19:11:2b:7e:d1:f0:21:85:4c:62:a2:7c:28:49:f0:28Certificate
IssuerCN=Miele SLQL0 Scout RX2 Runner Bronze/BrownNot Before01/07/2023, 19:35Not After02/07/2033, 19:35SubjectCN=Miele SLQL0 Scout RX2 Runner Bronze/Brown39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before03/05/2023, 00:00Not After02/08/2034, 23:59SubjectCN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02/05/2019, 00:00Not After18/01/2038, 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
aa:9b:46:7e:19:ca:b4:a2:b7:f3:69:45:af:0e:32:1c:4a:48:e2:17:a2:f8:15:b8:fa:46:1d:bc:30:d0:6e:bfSigner
Actual PE Digestaa:9b:46:7e:19:ca:b4:a2:b7:f3:69:45:af:0e:32:1c:4a:48:e2:17:a2:f8:15:b8:fa:46:1d:bc:30:d0:6e:bfDigest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 39KB - Virtual size: 96KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 543KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 256KB - Virtual size: 256KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ