Behavioral task
behavioral1
Sample
ad68b573ce00db5608871f4a64c1f92bf77f63be5f149d7cbb176d24d63d12fd.exe
Resource
win7-20231023-en
General
-
Target
ad68b573ce00db5608871f4a64c1f92bf77f63be5f149d7cbb176d24d63d12fd
-
Size
4.6MB
-
MD5
18522f12bc42b23be611bd4d961d7bff
-
SHA1
6c37991adeb58df30b3476acddb97ac7152d2662
-
SHA256
ad68b573ce00db5608871f4a64c1f92bf77f63be5f149d7cbb176d24d63d12fd
-
SHA512
019df8189e2889fb500c849faee9984f2bb42ac74ffe843eb6f964febdea48a3ef8963f02d38f233a4abd8156dee543a14da786dfa5e6025e3ab34f0020dafb3
-
SSDEEP
98304:eCW09WU/YIwrjBfXYFqI90NtacMc4eH+vIQIglP/L0GKqB9wgtz05M6:eCpfurjRoF390FL7evtplnPKqB9wgtwf
Malware Config
Signatures
-
resource yara_rule sample themida
Files
-
ad68b573ce00db5608871f4a64c1f92bf77f63be5f149d7cbb176d24d63d12fd.exe windows:4 windows x86 arch:x86
Code Sign
4e:04:2c:42:f9:de:68:8e:4a:6f:c2:f8:41:40:d4:f9Certificate
IssuerCN=Logitech H153 Wired Headset Black 2.0 overhead 20 Hz - 20000 Hz 22Ω corded cable - 1.8 mNot Before23-11-2023 09:28Not After24-11-2033 09:28SubjectCN=Logitech H153 Wired Headset Black 2.0 overhead 20 Hz - 20000 Hz 22Ω corded cable - 1.8 m39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before03-05-2023 00:00Not After02-08-2034 23:59SubjectCN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02-05-2019 00:00Not After18-01-2038 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
05:70:26:ca:fc:fb:54:ae:03:3b:d9:37:5b:3b:37:bb:c6:6a:da:83:e9:6f:a3:eb:2f:66:ae:72:be:c1:7a:44Signer
Actual PE Digest05:70:26:ca:fc:fb:54:ae:03:3b:d9:37:5b:3b:37:bb:c6:6a:da:83:e9:6f:a3:eb:2f:66:ae:72:be:c1:7a:44Digest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 83KB - Virtual size: 176KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 502KB - Virtual size: 845KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 4.0MB - Virtual size: 4.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ