Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10-20231215-en
Behavioral task
behavioral3
Sample
file.exe
Resource
win10v2004-20231222-en
General
-
Target
file.exe
-
Size
3.9MB
-
MD5
63aebc18a567a7505904d389bdeacea7
-
SHA1
d638828171b31c8321ea3b0744914ea371915434
-
SHA256
d4cc1d0a9d877794c120852e9ceab34983fcf2c1e4d4f4a131826a4e8c47a348
-
SHA512
14e03c98b25d19f60547c263216b75a664cc29663b0093a5cf99b0741f71ac35678cd7d45a7c1a3fd1014a8ba961b4bdea265e3bc53cdc80a2556713b7139973
-
SSDEEP
49152:cE1F6eQ+y5kyPXKITf2476sJzZ0yT8W+J6YDUCOrFq6gtgIy6JVDBSmmTqG+1A:cVf24fF0yT87KJcmWrdoq2
Malware Config
Signatures
-
resource yara_rule sample themida
Files
-
file.exe.exe windows:6 windows x86 arch:x86
Code Sign
5b:7d:41:7b:ac:e4:f2:90:46:b3:6b:96:ee:9e:7d:26Certificate
IssuerCN=jbl Słuchawki nauszne JBL LIVE 900 BiałyNot Before31/08/2022, 14:24Not After01/09/2032, 14:24SubjectCN=jbl Słuchawki nauszne JBL LIVE 900 Biały90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before11/05/2022, 00:00Not After10/08/2033, 23:59SubjectCN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02/05/2019, 00:00Not After18/01/2038, 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
b0:ae:fc:71:97:81:5d:27:82:dc:2f:f9:b0:5f:af:26:9e:08:c9:ee:03:4c:ab:3a:65:cc:dd:9b:29:4e:3c:b4Signer
Actual PE Digestb0:ae:fc:71:97:81:5d:27:82:dc:2f:f9:b0:5f:af:26:9e:08:c9:ee:03:4c:ab:3a:65:cc:dd:9b:29:4e:3c:b4Digest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 97KB - Virtual size: 183KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 28KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 1024B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 8KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.themida Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 16B - Virtual size: 4KB
IMAGE_SCN_MEM_READ