Static task
static1
Behavioral task
behavioral1
Sample
8ff3f51776ed5ef872a5e69f6c641503.exe
Resource
win7-en-20211208
General
-
Target
8ff3f51776ed5ef872a5e69f6c641503
-
Size
2.7MB
-
MD5
8ff3f51776ed5ef872a5e69f6c641503
-
SHA1
109691db87426c824f806c13320fd1220303e488
-
SHA256
d230980a059638f28c204c2d94839c60bea25cd9332a52b4ea66e340e2923950
-
SHA512
b0d294731a129c4f42a9ce1b9eb6f3bcf8283f41abcbb82999a46844501c1f2d051518074d056919ed5566dff42fc90a03909f7c23d6a17478a0a7b7da1277e4
-
SSDEEP
49152:C/1FgmMGmTJBZO0za0RuFxW41rePG7kwkORjvRo5N9iA3HuL83qRNL9Ih:C96f9BTO/BTRzRo5mA3OwI
Malware Config
Signatures
-
Processes:
resource yara_rule sample themida
Files
-
8ff3f51776ed5ef872a5e69f6c641503.exe windows x86
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 55KB - Virtual size: 97KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 13KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 2.6MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ