Behavioral task
behavioral1
Sample
d08d686c6b88aae873e265d9f7578ea915432f6fbde88f287a866818f2449aec.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
d08d686c6b88aae873e265d9f7578ea915432f6fbde88f287a866818f2449aec.exe
Resource
win10-20240404-en
General
-
Target
d08d686c6b88aae873e265d9f7578ea915432f6fbde88f287a866818f2449aec
-
Size
5.9MB
-
MD5
2846ca0568818dea5e64420f9864a15a
-
SHA1
ea3aafced1beeb897bdd7b0bfa838e7c54923eaa
-
SHA256
d08d686c6b88aae873e265d9f7578ea915432f6fbde88f287a866818f2449aec
-
SHA512
31ee82577b2cac836656057da91d13482760d006fab288a876e5447f6232313b9278c26e90e83a5214c322fd19a0fdb3f2dc871df39316fdb5510add7575e47d
-
SSDEEP
49152:onPKuySikreDzoEQcwpgF5aQBhD5KkGW1lCpWHZkay++5Sru4SakCZ3Kbq5idnT7:onfyA8UEblj79gmCMHZ7DZH5idX
Malware Config
Signatures
-
resource yara_rule sample themida
Files
-
d08d686c6b88aae873e265d9f7578ea915432f6fbde88f287a866818f2449aec.exe windows:6 windows x64 arch:x64
Code Sign
12:3b:42:9c:3a:fd:48:a3:45:58:ff:52:0d:42:4f:c4Certificate
IssuerCN=AVG Technologies USA LLC �¡ @�Not Before03/01/2024, 10:48Not After04/01/2034, 10:48SubjectCN=AVG Technologies USA LLC �¡ @�39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before03/05/2023, 00:00Not After02/08/2034, 23:59SubjectCN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02/05/2019, 00:00Not After18/01/2038, 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
86:e4:81:09:1a:c7:9a:3a:6c:53:ba:39:93:bb:d2:29:8e:6d:2d:75:f3:2e:8d:2b:5e:10:d6:5b:55:ac:a4:93Signer
Actual PE Digest86:e4:81:09:1a:c7:9a:3a:6c:53:ba:39:93:bb:d2:29:8e:6d:2d:75:f3:2e:8d:2b:5e:10:d6:5b:55:ac:a4:93Digest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Sections
Size: 716KB - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 164KB - Virtual size: 164KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.themida Size: 5.1MB - Virtual size: 5.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE