Behavioral task
behavioral1
Sample
742013fb201a108d224395cc2a712721.exe
Resource
win7-20231215-en
General
-
Target
742013fb201a108d224395cc2a712721
-
Size
2.4MB
-
MD5
742013fb201a108d224395cc2a712721
-
SHA1
48168543f47358ebbb6ffc7e445534af0d3654b8
-
SHA256
dbab5e45e4a28ec229afbc58c1918571c5eee96e09e0a2db5830f4c017e7867c
-
SHA512
1337ff64d7600a3f9f6baf4ea96774f8420769df9d653e652cd927225c5bded69b66dec3e6e5ea1c7e0f80c788488913cf9105a4831bf1a8e69cd374f23e9417
-
SSDEEP
49152:payfmRWv0j7H91TDdg41538Yg+g64rl0C0dmDSFt4HX:NfmRNPTZgq2Yg+Z5C04HX
Malware Config
Signatures
-
resource yara_rule sample themida
Files
-
742013fb201a108d224395cc2a712721.exe windows:4 windows x86 arch:x86
Code Sign
52:7c:4d:02:12:39:1b:8b:4c:fa:56:9e:4b:33:28:91Certificate
IssuerCN=Sony SEL-55210 55-210mm F4.5-6.3Not Before23/07/2021, 12:06Not After24/07/2031, 12:06SubjectCN=Sony SEL-55210 55-210mm F4.5-6.38c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before23/10/2020, 00:00Not After22/01/2032, 23:59SubjectCN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02/05/2019, 00:00Not After18/01/2038, 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
db:b5:15:1a:56:64:94:9d:c3:8a:e3:bc:de:22:dc:17:3f:de:a8:f9:70:09:7f:20:5b:b3:46:4d:22:e0:c3:87Signer
Actual PE Digestdb:b5:15:1a:56:64:94:9d:c3:8a:e3:bc:de:22:dc:17:3f:de:a8:f9:70:09:7f:20:5b:b3:46:4d:22:e0:c3:87Digest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 77KB - Virtual size: 184KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 59KB - Virtual size: 228KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 227KB - Virtual size: 227KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 4.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ