Behavioral task
behavioral1
Sample
a8b0a923d7a3c0b4f4bf9c576d9f41af4fe8cfab022d60d26e889ff58e2a3e71.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
a8b0a923d7a3c0b4f4bf9c576d9f41af4fe8cfab022d60d26e889ff58e2a3e71.exe
Resource
win10-20231215-en
General
-
Target
a8b0a923d7a3c0b4f4bf9c576d9f41af4fe8cfab022d60d26e889ff58e2a3e71
-
Size
4.4MB
-
MD5
48f8fa3cbbc9043e7abafd445a0c1a12
-
SHA1
8d1dc05ab88b4feda6984f5db8c93ae9797067e9
-
SHA256
a8b0a923d7a3c0b4f4bf9c576d9f41af4fe8cfab022d60d26e889ff58e2a3e71
-
SHA512
d996ae803369f0255b11f9044c0de245e750d1c094fcdfe6c7e6fb0e66c39912a46416928c2966f483ec28ee0dd266ae3e23fc19ce9f8d62f4572354bca0d792
-
SSDEEP
98304:N5Di+wStwXYACgIrWyi0Fj00CApYThTSPrg26LWjvcgVBN:N5Di+H8YAVedF4hApYJsg24Wj0gVn
Malware Config
Signatures
-
resource yara_rule sample themida
Files
-
a8b0a923d7a3c0b4f4bf9c576d9f41af4fe8cfab022d60d26e889ff58e2a3e71.exe windows:4 windows x86 arch:x86
Code Sign
7d:d2:b3:07:cf:3e:50:82:4b:ca:c9:55:2f:7c:00:b9Certificate
IssuerCN=—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹Not Before18/12/2023, 20:00Not After19/12/2033, 20:00SubjectCN=—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before03/05/2023, 00:00Not After02/08/2034, 23:59SubjectCN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02/05/2019, 00:00Not After18/01/2038, 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
94:5a:15:03:a5:f4:75:ad:1f:25:1f:95:d4:0e:03:ce:95:b4:24:6d:4e:13:42:d1:05:3a:2b:0e:a2:cd:58:35Signer
Actual PE Digest94:5a:15:03:a5:f4:75:ad:1f:25:1f:95:d4:0e:03:ce:95:b4:24:6d:4e:13:42:d1:05:3a:2b:0e:a2:cd:58:35Digest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 1.9MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 105KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 157KB - Virtual size: 157KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 4.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ