c085dd87b5d18ee9c8ec38a2977440b5
- SHA256 d849f1f013d633d91a68258551a54b20246ea20b33775a7b29096f85d7f35bd5
Password
infected
Behavioral task
behavioral1
Sample
6ca26fbe131ceb76d05709c5df672110dc50148c791d8079eeb7d988025aef46.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
General
- Target c085dd87b5d18ee9c8ec38a2977440b5
- Size 5.0MB
- Sample241107-vrfhvavrhx
- SHA256 d849f1f013d633d91a68258551a54b20246ea20b33775a7b29096f85d7f35bd5
- MD5 c085dd87b5d18ee9c8ec38a2977440b5
- SHA1 0a95ad0535baeef34122bddd80f99bb62ee3ad26
- SHA512 c398d6b66913123024ee5c96731e7b6e0e0f5f9a8f71c0efb352e410277e2d1d0e1e437b972f01801c71a698e6db9900d68d822ca20eac63c54932ca7fbcbdc1
- SSDEEP 98304:OrgTFbeYp25aGhBrZXdAsjzAcu2tsnSDZc6K/jdZ/cAUdAEX9CrcGgDI1:nap7BrZN7w2un6/K//LEXEcxDI1
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/6ca26fbe131ceb76d05709c5df672110dc50148c791d8079eeb7d988025aef46 themida
File Explorer
-
c085dd87b5d18ee9c8ec38a2977440b5.7z 5.0MB
-
6ca26fbe131ceb76d05709c5df672110dc50148c791d8079eeb7d988025aef46.exe 5.1MB
6ca26fbe131ceb76d05709c5df672110dc50148c791d8079eeb7d988025aef46
- SHA256 6ca26fbe131ceb76d05709c5df672110dc50148c791d8079eeb7d988025aef46
- MD5 bddbc9360dfb7c83b96437a0ca77aae1
- SHA1 88c82298dd32e2826743caeca5b82acf6583eee7
- SHA512 2a066a7e0b38d1c755d67757e4fe67eb12fefcce4aca078ae5f3f554cfd60415a5676c82a0d9eb6de9eef9327cee8eb1038f45d730fa2314e561ea2120f21224
- SSDEEP 98304:YNd6oQypwQq73QOB6+KPZtshYIyVGf+GBycKgeE7lXK:Yb6oQewQqbQO0+KPLsiVs+GVKjE7l6
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
48:f4:ff:f5:d0:58:2f:82:df:31:86:e1:b2:72:ff:87:e4:39:54:66:f3:2c:4d:c7:4e:c9:69:f3:2d:7b:20:76
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=AVG Technologies USA\, LLC,OU=RE stapler cistodc,O=AVG Technologies USA\, LLC,L=Newton,ST=North Carolina,C=US
Chains
Jun 30, 2022
CN=AVG Technologies USA\, LLC,OU=RE stapler cistodc,O=AVG Technologies USA\, LLC,L=Newton,ST=North Carolina,C=US
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 22, 2013 - Oct 22, 2028
Subject
CN=AVG Technologies USA\, LLC,OU=RE stapler cistodc,O=AVG Technologies USA\, LLC,L=Newton,ST=North Carolina,C=US
Serial Number
0e:31:e4:8d:08:06:5b:09:8f:84:e7:c5:10:33:60:74
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 6, 2020 - Mar 15, 2023
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US
Serial Number
0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 29, 2022 - Mar 14, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jun 9, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
5
Entry point
14927848
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
Size
75KB
Virtual Size
190KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
Size
125KB
Virtual Size
7.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
512B
Virtual Size
75B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
512B
Virtual Size
74B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
243KB
Virtual Size
243KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.vm_sec
Size
96KB
Virtual Size
96KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.themida
Size
Virtual Size
6.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.boot
Size
4.6MB
Virtual Size
4.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
count=1, id=150, version=20413,
count=29, id=149, productName=VS2008 build 21022, version=21022,
count=136, id=131, productName=VS2008 build 21022, version=21022,
count=3, id=123, productName=VS2005 build 50727, version=50727,
count=209, id=1, productName=Unmarked objects,
count=62, id=132, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,