cb4118382e3f97f0db04938a4e31e3e1.bin
- SHA256 3a6610abad08c3e14c04f797c11d6723f8db2131593e83274744a01347415c2d
Password
infected
Behavioral task
behavioral1
Sample
fcd465bfb29ad1ee9c3344c27035fe6721f7c634ae714db808454b2d14e6ecd3.exe
Resource
win7-20240220-en
windows7-x64
9 signatures
150 seconds
General
- Target cb4118382e3f97f0db04938a4e31e3e1.bin
- Size 3.8MB
- Sample240422-ce2lfaeb32
- SHA256 3a6610abad08c3e14c04f797c11d6723f8db2131593e83274744a01347415c2d
- MD5 90297aba4df497680673cb0c2152f48c
- SHA1 4238491d13e63519916a7a3a40afa22a813fe496
- SHA512 b0502312c4d157595256f7a1367b116b0b6d5ba9744bd932a85c18a1235c43ec8e2d657bb5310612b4df034d310dce7d9e0a06da9690f132f5a11a71c20a9f86
- SSDEEP 98304:b9xDGldchjZlwesfRs5qPXmT6tszUJAIVjJwBDx8CgP5e:JxVjZrsfyAW2+UJpjJwhuY
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/fcd465bfb29ad1ee9c3344c27035fe6721f7c634ae714db808454b2d14e6ecd3.exe themida
File Explorer
-
cb4118382e3f97f0db04938a4e31e3e1.bin.zip 3.8MB
-
fcd465bfb29ad1ee9c3344c27035fe6721f7c634ae714db808454b2d14e6ecd3.exe.exe 4.1MB
fcd465bfb29ad1ee9c3344c27035fe6721f7c634ae714db808454b2d14e6ecd3.exe
- IMPHASH 023aae353653db016d3a89da454d1d86
- SHA256 fcd465bfb29ad1ee9c3344c27035fe6721f7c634ae714db808454b2d14e6ecd3
- MD5 cb4118382e3f97f0db04938a4e31e3e1
- SHA1 d31dff9e56df945247cbb0598bf0c1d27aedcccf
- SHA512 a37f4faef965c33f48af389016911ba3c255f14d7b4ee33fef6e20771844abeab37a273c60ee5501ccfbb5fecce5027201d08e4344a4ddbab672449cfb7b149c
- SSDEEP 98304:Ie7PCLZ0+LSlhnzXRhtvbp6DdM0NwIwUd3iXGNZ:IeDCsVzX3xoDhNbfd3iKZ
- MD5 SHA1 SHA512 SSDEEP
Password
infected
PE Signature issue
Digest
d8:db:65:9e:0f:7c:ef:62:65:4b:32:66:f0:b6:12:ad:41:69:07:50:34:ed:90:d0:2e:33:7b:f7:ec:42:47:50
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=œáz±åz±åz±æz±åz±åz±åzœáz±åz±åz±æz±åz±åz±åzœáz±åz±åz±æz±åz±åz±åzœáz±åz±åz±æz±åz±åz±åzœáz±åz±åz±æz±åz±åz±åzœáz±åz±åz±æz±åz±åz±åzœáz±åz±åz±æz±åz±åz±åzœáz±åz±åz±æz±åz±åz±åzœáz±åz±åz±æz±åz±åz±åzœáz±åz±åz±æz±åz±åz±åzœáz±åz±åz±æz±åz±åz±åz
Chains
Apr 18, 2024
Subject
CN=œáz±åz±åz±æz±åz±åz±åzœáz±åz±åz±æz±åz±åz±åzœáz±åz±åz±æz±åz±åz±åzœáz±åz±åz±æz±åz±åz±åzœáz±åz±åz±æz±åz±åz±åzœáz±åz±åz±æz±åz±åz±åzœáz±åz±åz±æz±åz±åz±åzœáz±åz±åz±æz±åz±åz±åzœáz±åz±åz±æz±åz±åz±åzœáz±åz±åz±æz±åz±åz±åzœáz±åz±åz±æz±åz±åz±åz
Serial Number
3a:02:06:9d:08:4a:9b:ae:45:54:63:5c:0d:b9:5a:8d
Issuer
CN=œáz±åz±åz±æz±åz±åz±åzœáz±åz±åz±æz±åz±åz±åzœáz±åz±åz±æz±åz±åz±åzœáz±åz±åz±æz±åz±åz±åzœáz±åz±åz±æz±åz±åz±åzœáz±åz±åz±æz±åz±åz±åzœáz±åz±åz±æz±åz±åz±åzœáz±åz±åz±æz±åz±åz±åzœáz±åz±åz±æz±åz±åz±åzœáz±åz±åz±æz±åz±åz±åzœáz±åz±åz±æz±åz±åz±åz
Timespan
Apr 13, 2024 - Apr 14, 2034
Subject
CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 3, 2023 - Aug 2, 2034
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Minor OS version
0
Major OS version
6
Entry point
9928140
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetModuleHandleA
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress
user32
GetCursorPos
advapi32
RegCloseKey
shell32
SHGetFolderPathA
ole32
CoCreateInstance
oleaut32
VariantClear
Name
.text
Size
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
284KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.vmp(¿R
Size
Virtual Size
322KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.themida
Size
Virtual Size
4.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.vmp(¿R
Size
Virtual Size
408KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.vmp(¿R
Size
1024B
Virtual Size
976B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.vmp(¿R
Size
3.8MB
Virtual Size
3.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
323KB
Virtual Size
322KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ