Behavioral task
behavioral1
Sample
ba16d36bc5f915fd0f5eb51897c96f1e09c9d4be2baa711f43e405cc2cc5ae20.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral2
Sample
ba16d36bc5f915fd0f5eb51897c96f1e09c9d4be2baa711f43e405cc2cc5ae20.exe
Resource
win11-20240419-en
General
-
Target
ba16d36bc5f915fd0f5eb51897c96f1e09c9d4be2baa711f43e405cc2cc5ae20
-
Size
5.8MB
-
MD5
8cdbceb83e1ee642f606d9f805418607
-
SHA1
3296b0c31ed97022e033b5639157f592893d0780
-
SHA256
ba16d36bc5f915fd0f5eb51897c96f1e09c9d4be2baa711f43e405cc2cc5ae20
-
SHA512
c1f4d628da95e16da50818c45a2c1e264f9f8abdac8a224ed43072334db8dc2e07fca3c8bef1c2b917ae50b53b5e6358e6c65ae29d0a6f30cadd531027a08e87
-
SSDEEP
49152:rBjxqO8JVQ/XI4cJD4Enou5GtpDDmUCPPNnn5XkAWpNleXt0KhQ5FI8vvhfK:RxqO8HQPUEEMtpDithn5XUpmLh4vE
Malware Config
Signatures
-
resource yara_rule sample themida
Files
-
ba16d36bc5f915fd0f5eb51897c96f1e09c9d4be2baa711f43e405cc2cc5ae20.exe windows:6 windows x64 arch:x64
Code Sign
12:3b:42:9c:3a:fd:48:a3:45:58:ff:52:0d:42:4f:c4Certificate
IssuerCN=AVG Technologies USA LLC �¡ @�Not Before03/01/2024, 10:48Not After04/01/2034, 10:48SubjectCN=AVG Technologies USA LLC �¡ @�39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before03/05/2023, 00:00Not After02/08/2034, 23:59SubjectCN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02/05/2019, 00:00Not After18/01/2038, 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
56:a9:ad:37:d0:7c:7a:58:e5:35:b9:88:3b:4c:3c:c2:d4:bd:3c:bb:31:06:6a:46:a1:d1:52:31:89:91:15:5cSigner
Actual PE Digest56:a9:ad:37:d0:7c:7a:58:e5:35:b9:88:3b:4c:3c:c2:d4:bd:3c:bb:31:06:6a:46:a1:d1:52:31:89:91:15:5cDigest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Sections
Size: 715KB - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 196KB - Virtual size: 195KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.themida Size: 4.9MB - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE