Static task
static1
Behavioral task
behavioral1
Sample
d9fbf489c999137459a8a3d2e0caf002efe03e9f3cb18353a0b4cd8b0da46b49.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
d9fbf489c999137459a8a3d2e0caf002efe03e9f3cb18353a0b4cd8b0da46b49.exe
Resource
win10v2004-en-20220112
General
-
Target
d9fbf489c999137459a8a3d2e0caf002efe03e9f3cb18353a0b4cd8b0da46b49
-
Size
2.8MB
-
MD5
62eeb62816a7d36d4dac3aa66c685da8
-
SHA1
64b97b69c0bda0e472bd9dba9de9fe01d0ed7315
-
SHA256
d9fbf489c999137459a8a3d2e0caf002efe03e9f3cb18353a0b4cd8b0da46b49
-
SHA512
7642c425311aba0d65117654dfb7fe1ad930bc0eb7dabeab559b48e8a301581bb66662320a817eef1e3f672228b317d7123cb93b9385d6c1e209675673cedc67
-
SSDEEP
49152:PpJmimeJtKnfJiEuioPoVlurbdXWwXcGzmCWJccV+4nhSjlifTJaSw:PNmat0xiEuiA4lurpX//mCWr/nClETJ
Malware Config
Signatures
-
Processes:
resource yara_rule sample themida
Files
-
d9fbf489c999137459a8a3d2e0caf002efe03e9f3cb18353a0b4cd8b0da46b49.exe windows x86
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 90KB - Virtual size: 192KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 508KB - Virtual size: 515KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.themida Size: - Virtual size: 3.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
turismiw Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
turismiw Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ