Behavioral task
behavioral1
Sample
ec0112fa3d908d7bc33a63a427fed19745dd19759bb450b5b6f21daef9cde777.exe
Resource
win7-20240419-en
General
-
Target
ec0112fa3d908d7bc33a63a427fed19745dd19759bb450b5b6f21daef9cde777
-
Size
2.7MB
-
MD5
69c6b12cc698515b870df51f7c4ac266
-
SHA1
b1e36432e4515ebf5b0148c64fb8dad7c3908ecf
-
SHA256
ec0112fa3d908d7bc33a63a427fed19745dd19759bb450b5b6f21daef9cde777
-
SHA512
cb3f2916355dcf33035444ba99160e4a0111dc661ef13e9853101bb51c244d55e76c2f3dec09e1f372f1b00e4a26bf8acc60a73ed1e80b57d7efe12bf47fd789
-
SSDEEP
49152:BzlAeowdixo4MBEHVr3LlWNoEYyo8dXup/uZWuoyTigQ4OA:B9ZE9LUbO8NuMZuyTiglOA
Malware Config
Signatures
-
resource yara_rule sample themida
Files
-
ec0112fa3d908d7bc33a63a427fed19745dd19759bb450b5b6f21daef9cde777.exe windows:4 windows x86 arch:x86
Code Sign
3e:58:7f:9b:be:a1:a3:a3:49:74:33:29:7e:54:fe:a8Certificate
IssuerCN=%¾®¢ª%..%¾®¢ª%..%¾®¢ª%..%¾®¢ª%.%¾®¢ª%..%¾®¢ª%..%¾®¢ª%..%¾®¢ª%.%¾®¢ª%..%¾®¢ª%..%¾®¢ª%..%¾®¢ª%.%¾®¢ª%..%¾®¢ª%..%¾®¢ª%..%¾®¢ª%.%¾®¢ª%..%¾®¢ª%..%¾®¢ª%..%¾®¢ª%.%¾®¢ª%..%¾®¢ª%..%¾®¢ª%..%¾®¢ª%.%¾®¢ª%..%¾®¢ª%..%¾®¢ª%..%¾®¢ª%.%¾®¢ª%..%¾®¢ª%..%¾®¢ª%..%¾®¢ª%.%¾®¢ª%..%¾®¢ª%..%¾®¢ª%..%¾®¢ª%.%¾®¢ª%..%¾®¢ª%..%¾®¢ª%..%¾®¢ª%.Not Before25/10/2023, 09:56Not After26/10/2033, 09:56SubjectCN=%¾®¢ª%..%¾®¢ª%..%¾®¢ª%..%¾®¢ª%.%¾®¢ª%..%¾®¢ª%..%¾®¢ª%..%¾®¢ª%.%¾®¢ª%..%¾®¢ª%..%¾®¢ª%..%¾®¢ª%.%¾®¢ª%..%¾®¢ª%..%¾®¢ª%..%¾®¢ª%.%¾®¢ª%..%¾®¢ª%..%¾®¢ª%..%¾®¢ª%.%¾®¢ª%..%¾®¢ª%..%¾®¢ª%..%¾®¢ª%.%¾®¢ª%..%¾®¢ª%..%¾®¢ª%..%¾®¢ª%.%¾®¢ª%..%¾®¢ª%..%¾®¢ª%..%¾®¢ª%.%¾®¢ª%..%¾®¢ª%..%¾®¢ª%..%¾®¢ª%.%¾®¢ª%..%¾®¢ª%..%¾®¢ª%..%¾®¢ª%.39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before03/05/2023, 00:00Not After02/08/2034, 23:59SubjectCN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02/05/2019, 00:00Not After18/01/2038, 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
4c:09:c7:ba:af:e0:4b:5c:cd:15:00:82:37:b0:fd:83:60:dc:95:83:11:ff:32:d4:5d:9d:e6:9f:ed:76:39:ddSigner
Actual PE Digest4c:09:c7:ba:af:e0:4b:5c:cd:15:00:82:37:b0:fd:83:60:dc:95:83:11:ff:32:d4:5d:9d:e6:9f:ed:76:39:ddDigest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 69KB - Virtual size: 184KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 91KB - Virtual size: 113KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 106KB - Virtual size: 106KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ