Behavioral task
behavioral1
Sample
b97b119d7aa0317dd791c072810d49ae.exe
Resource
win7-20240220-en
General
-
Target
b97b119d7aa0317dd791c072810d49ae
-
Size
3.5MB
-
MD5
b97b119d7aa0317dd791c072810d49ae
-
SHA1
9d45d400bd87543109b0fa4ccade6d0cb87c7324
-
SHA256
fa7fd8469e83536604c81b88d93e53668ad1347865f61d8ec5b1d95bdf6185e4
-
SHA512
94510b6d98ee7bca104ef83e65d485a16f1a5cd1f851c400ce4129a296c5a8e87c613e0bd39f0d28522114f320a511cf76b1fc6fbea58e92199058984086401a
-
SSDEEP
98304:ULIhghiAKpv9duJ8mdtQw5w5jC3LygSvtNDG4XhK0oE:ULsMpKxcbQYwSytND+E
Malware Config
Signatures
Files
-
b97b119d7aa0317dd791c072810d49ae.exe windows:4 windows x86 arch:x86
Code Sign
11:c6:8e:99:34:f2:98:99:45:47:f4:f0:75:ad:fa:4dCertificate
IssuerCN=Logitech Mobile Speakerphone P710eNot Before25-07-2021 22:52Not After26-07-2031 22:52SubjectCN=Logitech Mobile Speakerphone P710e8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before23-10-2020 00:00Not After22-01-2032 23:59SubjectCN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02-05-2019 00:00Not After18-01-2038 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
dc:4e:60:7d:d6:36:8e:d0:1f:8b:41:f6:42:4a:65:42:72:ac:23:39:e5:32:73:ba:70:39:6c:02:50:08:c8:21Signer
Actual PE Digestdc:4e:60:7d:d6:36:8e:d0:1f:8b:41:f6:42:4a:65:42:72:ac:23:39:e5:32:73:ba:70:39:6c:02:50:08:c8:21Digest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 180KB - Virtual size: 184KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 1.1MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
▪️GO Size: 100KB - Virtual size: 100KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 4.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
▪️GO Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 100KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ