Behavioral task
behavioral1
Sample
24df6419a2fbb827df344e0ab5a29a38a5d551169001c284bbc4c1dcab378720.exe
Resource
win7-20240220-en
General
-
Target
24df6419a2fbb827df344e0ab5a29a38a5d551169001c284bbc4c1dcab378720
-
Size
2.1MB
-
MD5
ab795b3cae298cbf05fd14abf2009eb0
-
SHA1
61499edfb26e006dbfea514c99856842afd0cce1
-
SHA256
24df6419a2fbb827df344e0ab5a29a38a5d551169001c284bbc4c1dcab378720
-
SHA512
5860f8e3e36fd7c93accdf5014cc5fd8c50d184c6822e97160953502d8dc90081203b0e0333405f90ca4349d3a9b23a038f9871e814179b1f2cc13d6df63015d
-
SSDEEP
49152:tTl2f2spwCijqlcds2dfFGDF84ncI/PdyVgsPq:tT5siZjqo1glcIHdt
Malware Config
Signatures
-
resource yara_rule sample themida
Files
-
24df6419a2fbb827df344e0ab5a29a38a5d551169001c284bbc4c1dcab378720.exe windows:4 windows x86 arch:x86
Code Sign
63:24:4d:30:d2:a1:4a:b4:4a:ad:bd:9a:36:e4:da:5aCertificate
IssuerCN=HDD Toshiba SATA-III 10Tb HDWG460EZSTA N300 (7200rpm) 4096Mb 2.5 RtlNot Before10/12/2022, 12:00Not After11/12/2032, 12:00SubjectCN=HDD Toshiba SATA-III 10Tb HDWG460EZSTA N300 (7200rpm) 4096Mb 2.5 Rtl39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before03/05/2023, 00:00Not After02/08/2034, 23:59SubjectCN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02/05/2019, 00:00Not After18/01/2038, 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
28:d0:a5:f2:9c:1e:c9:f5:c2:6f:d9:12:88:9d:d6:7c:15:51:1a:26:9c:bf:ea:b0:82:80:b8:bd:7c:55:19:51Signer
Actual PE Digest28:d0:a5:f2:9c:1e:c9:f5:c2:6f:d9:12:88:9d:d6:7c:15:51:1a:26:9c:bf:ea:b0:82:80:b8:bd:7c:55:19:51Digest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 69KB - Virtual size: 176KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 26KB - Virtual size: 148KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 4.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ