Behavioral task
behavioral1
Sample
3c3460909840013ea74eb40af73f76085af6a9d2fe5370c942a6d1ec19a95603.exe
Resource
win10v2004-20240226-en
General
-
Target
3c3460909840013ea74eb40af73f76085af6a9d2fe5370c942a6d1ec19a95603
-
Size
2.9MB
-
MD5
22ecefc71c0f4833c58eb5341f2c5665
-
SHA1
d75bfc67dbbb1d3ddc63a79ef05419df09ea6ac4
-
SHA256
3c3460909840013ea74eb40af73f76085af6a9d2fe5370c942a6d1ec19a95603
-
SHA512
55e7194e1c477c32d484bb7027baee11c93bf750dee9c79f9a81e87e7bd4723b3528063c9a3f3b9dc719b10a163493990dbfbb9b65031d89b6da9f44ed5aca2f
-
SSDEEP
49152:+6uEM8aY79/+vM0dTDbyWMFR4Ve7Y0X2KvAoJF2Vs5/Z59QfrGgLZbuKvYVWt3:aENb7d+vMsDBNVFu2MAMFaYufr7/PJ
Malware Config
Signatures
-
resource yara_rule sample themida
Files
-
3c3460909840013ea74eb40af73f76085af6a9d2fe5370c942a6d1ec19a95603.exe windows:6 windows x64 arch:x64
Code Sign
e5:d7:80:37:42:56:b5:45:9a:81:ab:17:18:0c:15:5fCertificate
IssuerCN=MSI PRO B760-P WIFI DDR4,OU=\ Intel Gen Core Pentium,O=\ Intel,ST=\ Realtek ALC897,C=6E BluetoothNot Before22/01/2024, 09:38Not After26/06/2025, 00:00SubjectCN=MSI PRO B760-P WIFI DDR4,OU=\ Intel Gen Core Pentium,O=\ Intel,ST=\ Realtek ALC897,C=6E Bluetooth39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before03/05/2023, 00:00Not After02/08/2034, 23:59SubjectCN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02/05/2019, 00:00Not After18/01/2038, 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
55:76:6a:5d:cd:13:0f:87:3e:a5:c5:7d:65:0b:d6:30:a6:6f:02:f6:2d:c3:7d:32:50:e5:69:a2:e0:8b:30:36Signer
Actual PE Digest55:76:6a:5d:cd:13:0f:87:3e:a5:c5:7d:65:0b:d6:30:a6:6f:02:f6:2d:c3:7d:32:50:e5:69:a2:e0:8b:30:36Digest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 565KB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 97KB - Virtual size: 284KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 4KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 22KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 42KB - Virtual size: 131KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 3KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 77KB - Virtual size: 77KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 5.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 16B - Virtual size: 4KB
IMAGE_SCN_MEM_READ