Behavioral task
behavioral1
Sample
d31a4a299e1c137637e2a084b5d77cb9684df82e662e7edbec792ba0f76b9106.exe
Resource
win7-20240221-en
General
-
Target
d31a4a299e1c137637e2a084b5d77cb9684df82e662e7edbec792ba0f76b9106
-
Size
2.5MB
-
MD5
9391b2a6a73923d51c76addc9e809f12
-
SHA1
169631be20d03d40d37cd54617523e57f8ee844f
-
SHA256
d31a4a299e1c137637e2a084b5d77cb9684df82e662e7edbec792ba0f76b9106
-
SHA512
c48fa0df23962d0106d04d3259992102ef66a8dadf3655de425ad4de1b70d2e1ac713814e903fb647070343f28a8cc8bad1ae9dc46aa3ed1a926c98ed1f0ee9a
-
SSDEEP
49152:5nyF5ift0cTzzIdz6aSQn7Zux2SJd1znGO7BOyFz2TRBNRfihOZ5GVbLou5+:IF8fqcTzze+avn7ZuAWd1ttOuzWdKOyk
Malware Config
Signatures
-
resource yara_rule sample themida
Files
-
d31a4a299e1c137637e2a084b5d77cb9684df82e662e7edbec792ba0f76b9106.exe windows:6 windows x86 arch:x86
Code Sign
59:ae:12:33:e1:80:68:97:43:8d:f0:ee:c7:05:1e:17Certificate
IssuerCN=AVG Technologies USA LLC ™‰™‰™‰Not Before06/01/2024, 10:14Not After07/01/2034, 10:14SubjectCN=AVG Technologies USA LLC ™‰™‰™‰39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before03/05/2023, 00:00Not After02/08/2034, 23:59SubjectCN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02/05/2019, 00:00Not After18/01/2038, 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
71:ee:22:8e:94:dd:b9:d4:50:8e:b5:8c:07:96:c8:ef:e3:56:d9:f8:30:e6:2b:20:3e:25:ca:24:49:ad:41:09Signer
Actual PE Digest71:ee:22:8e:94:dd:b9:d4:50:8e:b5:8c:07:96:c8:ef:e3:56:d9:f8:30:e6:2b:20:3e:25:ca:24:49:ad:41:09Digest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 514KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 41KB - Virtual size: 124KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 5KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 508KB - Virtual size: 507KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 18KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.themida Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 16B - Virtual size: 4KB
IMAGE_SCN_MEM_READ