Behavioral task
behavioral1
Sample
bb.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
bb.exe
Resource
win10v2004-20230703-en
General
-
Target
bb.exe
-
Size
3.7MB
-
MD5
6515bf0a90de21df321b8d6c8af1e3a6
-
SHA1
66bd3231249fc2bc4f3e26c429a0db2984b76558
-
SHA256
0539d46a6e61dd3ce32a4b41c0554f925f4b26054c49451accec7ccad0409846
-
SHA512
d86dbf68a6342f7d6903a6b3472125456986514cf39106ae9ff525a178ccc7c18cabd14a8f97a89ad5329bf8c6f2eafabdfc0846e191766919f0f30cba7072e8
-
SSDEEP
49152:oOnjDmNlq/z9dkXB4Es9UR729XyA9Pc0bmzkQduF+mGpuTAmtv:JnkXB4EsOR69Xhc0bmz3oopuTAmtv
Malware Config
Signatures
-
resource yara_rule sample themida
Files
-
bb.exe.exe windows x86
Code Sign
19:11:2b:7e:d1:f0:21:85:4c:62:a2:7c:28:49:f0:28Certificate
IssuerCN=Miele SLQL0 Scout RX2 Runner Bronze/BrownNot Before01/07/2023, 19:35Not After02/07/2033, 19:35SubjectCN=Miele SLQL0 Scout RX2 Runner Bronze/Brown39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before03/05/2023, 00:00Not After02/08/2034, 23:59SubjectCN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02/05/2019, 00:00Not After18/01/2038, 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
18:b3:14:58:83:64:a9:7e:6a:51:21:31:95:67:f1:73:f3:29:1a:db:00:87:d9:87:a6:fe:94:b7:8b:ce:86:ddSigner
Actual PE Digest18:b3:14:58:83:64:a9:7e:6a:51:21:31:95:67:f1:73:f3:29:1a:db:00:87:d9:87:a6:fe:94:b7:8b:ce:86:ddDigest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 70KB - Virtual size: 163KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 12KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.themida Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 16B - Virtual size: 4KB
IMAGE_SCN_MEM_READ