Behavioral task
behavioral1
Sample
66e5a85f74c1bb52d467a0cdeeb236bf.exe
Resource
win7-20231215-en
General
-
Target
66e5a85f74c1bb52d467a0cdeeb236bf
-
Size
4.1MB
-
MD5
66e5a85f74c1bb52d467a0cdeeb236bf
-
SHA1
eac5b579bd0142c10e13bc5bfb7e8041bbd81eba
-
SHA256
3331b89ba4fc73989d27176a21f5f5e6906c3eb54cf7db0c092e8db8b6afb83c
-
SHA512
4bfa57b2a451f90c99ce5f71752baf0b1c507658e957589678094a0661727eb029a0e0ec56d962b86f3ac8b85088b4c402ae8f3447b598df9ea043262f30946f
-
SSDEEP
98304:+qfhQ15twM4HUAfl+Lqped+uX2tfb4V0FzDCathoM5TFOe5:+yHUAfl+Lqpm0h4V2tz1dMe5
Malware Config
Signatures
-
resource yara_rule sample themida
Files
-
66e5a85f74c1bb52d467a0cdeeb236bf.exe windows:4 windows x86 arch:x86
Code Sign
35:c1:24:ac:6a:f0:55:aa:45:ea:d8:53:66:ca:78:3dCertificate
IssuerCN=HP EliteDesk 800 G6 TWRNot Before01/08/2021, 17:24Not After02/08/2031, 17:24SubjectCN=HP EliteDesk 800 G6 TWR8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before23/10/2020, 00:00Not After22/01/2032, 23:59SubjectCN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02/05/2019, 00:00Not After18/01/2038, 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
19:74:e6:03:90:a6:bc:70:b1:43:96:59:bb:12:d3:f0:17:cd:5a:77:37:4a:7b:66:2f:33:ac:cf:c9:94:f9:0bSigner
Actual PE Digest19:74:e6:03:90:a6:bc:70:b1:43:96:59:bb:12:d3:f0:17:cd:5a:77:37:4a:7b:66:2f:33:ac:cf:c9:94:f9:0bDigest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 78KB - Virtual size: 184KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 1.1MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
6️⃣ Size: 102KB - Virtual size: 102KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
6️⃣ Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
6️⃣ Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 102KB - Virtual size: 101KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ