Static task
static1
Behavioral task
behavioral1
Sample
595728d3602df8a2930eeb36232f43624d93049d5793ea8acf98964427f0f532.exe
Resource
win7-en-20211208
General
-
Target
595728d3602df8a2930eeb36232f43624d93049d5793ea8acf98964427f0f532
-
Size
3.2MB
-
MD5
b3a3605b1768e34126afb8cb065a1ef9
-
SHA1
1aa6029292bf5c72b03e62ec8708ba992da0ec9b
-
SHA256
595728d3602df8a2930eeb36232f43624d93049d5793ea8acf98964427f0f532
-
SHA512
f8c5cc965ea6c4fd660934d5c074849c6d20ec5e5bea2d0b8dae609bc88147f11d91cc2b994f8e60ff08eaed28cd57a5cbf272ea5a6b7522ed2c2e9adf22d8bd
-
SSDEEP
49152:ab9nBOk0I53RW7wq/jQZIkEEE/kd37mvGs3JENwwE6bqjK07Y5ZWtxMP31RYqmd:Gzl3RAwsVktHZ74GZEyr0MBvoqmI
Malware Config
Signatures
-
Processes:
resource yara_rule sample themida
Files
-
595728d3602df8a2930eeb36232f43624d93049d5793ea8acf98964427f0f532.exe windows x64
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 44KB - Virtual size: 83KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 21KB - Virtual size: 61KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 5KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 236B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.themida Size: - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 3.2MB - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ