Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20230915-en
General
-
Target
file.exe
-
Size
3.0MB
-
MD5
4a62a863daffe988e9a1fe126234dbbd
-
SHA1
6e9c2ca97366ce733e4f88ccb4e6d6411efaa208
-
SHA256
531b98c17443cbcf4e821e91f5b84cae088f30f7c1157c63bcf7f90f105e6c85
-
SHA512
62887e4ca8b50825084bbcf1e8fd1da032a8794cca432965194b5020e7679bb4a902953e0173964a4da04fad2183a7d7e0af7d64d4411c1567e69087ba1af70d
-
SSDEEP
49152:hN94VVApj6nT2eMYmM4i6haea0GNG7f+Mj1zP/zEv8m7kRDxP/SpMTCnzK8ZTXfi:JUaj6CD0maxzNGPjhzEloxbMZ7re
Malware Config
Signatures
-
resource yara_rule sample themida
Files
-
file.exe.exe windows:6 windows x86
Code Sign
1f:b8:fb:34:1b:ad:b8:8a:42:98:d8:3e:97:c5:85:21Certificate
IssuerCN=SSD Western Digital Blue SA510 1 ТБ SATA (WDS100T3B0A)Not Before28-05-2023 12:56Not After29-05-2033 12:56SubjectCN=SSD Western Digital Blue SA510 1 ТБ SATA (WDS100T3B0A)39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before03-05-2023 00:00Not After02-08-2034 23:59SubjectCN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02-05-2019 00:00Not After18-01-2038 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
30:9a:b2:6f:e2:cf:96:86:3e:9f:cb:88:98:f8:3a:bb:01:cf:94:45:c0:63:e5:f4:1c:f3:2f:0f:bf:8c:6d:0eSigner
Actual PE Digest30:9a:b2:6f:e2:cf:96:86:3e:9f:cb:88:98:f8:3a:bb:01:cf:94:45:c0:63:e5:f4:1c:f3:2f:0f:bf:8c:6d:0eDigest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 501KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 105KB - Virtual size: 199KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 2KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 170KB - Virtual size: 459KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 20KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 135KB - Virtual size: 135KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ