Behavioral task
behavioral1
Sample
AB7BEDC617F28955264DADF4B6C31EB8.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
AB7BEDC617F28955264DADF4B6C31EB8.exe
Resource
win10v2004-20230915-en
General
-
Target
AB7BEDC617F28955264DADF4B6C31EB8.exe
-
Size
2.1MB
-
MD5
ab7bedc617f28955264dadf4b6c31eb8
-
SHA1
61a58055d01ce42179ea9e9d6c1d012dfbdc6210
-
SHA256
e3875d66fb5199a699830792dba7863964a8b5d75bce9814facb7066e2e8b170
-
SHA512
703dbc117039ea65da989c833ac2ea91460544b9f197d2feceee49c7b24276296e5c042095c7be0bd59d7392a1ba6991337694fe6283ab43426c34d10f7b3aef
-
SSDEEP
49152:sFfpXvXfxHaU0/c0jWwplMwVY4x1kOTkaSGhSR5wz59:cvXfxHV0/cqhplM2SvRc
Malware Config
Signatures
-
resource yara_rule sample themida
Files
-
AB7BEDC617F28955264DADF4B6C31EB8.exe.exe windows:4 windows x86
Code Sign
7a:09:f4:ab:3a:2d:ff:a8:40:0e:d7:4a:6d:fa:2c:26Certificate
IssuerCN=HP EliteDesk 800 G6 TWR 272Y1EANot Before10/09/2023, 12:59Not After11/09/2033, 12:59SubjectCN=HP EliteDesk 800 G6 TWR 272Y1EA39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before03/05/2023, 00:00Not After02/08/2034, 23:59SubjectCN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02/05/2019, 00:00Not After18/01/2038, 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
71:c1:f6:b0:b3:2e:e0:56:30:54:d3:af:82:1b:46:cb:25:1c:47:ac:6c:81:fa:35:d2:44:e5:d2:00:09:c7:e7Signer
Actual PE Digest71:c1:f6:b0:b3:2e:e0:56:30:54:d3:af:82:1b:46:cb:25:1c:47:ac:6c:81:fa:35:d2:44:e5:d2:00:09:c7:e7Digest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 5KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 160KB - Virtual size: 227KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ