Static task
static1
Behavioral task
behavioral1
Sample
494ad1789b26feaff8bf273203aa76f3587f28cefd58184f8fe2ef011a2b5581.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
494ad1789b26feaff8bf273203aa76f3587f28cefd58184f8fe2ef011a2b5581.exe
Resource
win10v2004-en-20220112
General
-
Target
494ad1789b26feaff8bf273203aa76f3587f28cefd58184f8fe2ef011a2b5581
-
Size
3.6MB
-
MD5
c93df51b25b2bc23daf75e5ba6da3647
-
SHA1
6b390456b8c7980de89e4dfb0a08d72aacd17579
-
SHA256
494ad1789b26feaff8bf273203aa76f3587f28cefd58184f8fe2ef011a2b5581
-
SHA512
948101bf6b0f96d15a0d816a3a4c90407eb7f523985e0f1ca049a06df63ed4ccaed896198f30c27c047d1d5f2f4363758f4e116c4e339c96bd98f1894a82e899
-
SSDEEP
98304:MlOV7Cy5oy1U5u052dbIXtTFR+38MbxCffqCFaxtIp8kRjC:MlQx5fC5kbalFR+CA+p7jC
Malware Config
Signatures
-
Processes:
resource yara_rule sample themida
Files
-
494ad1789b26feaff8bf273203aa76f3587f28cefd58184f8fe2ef011a2b5581.exe windows x86
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 90KB - Virtual size: 192KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.themida Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
turismiw Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
turismiw Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 42KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ