Behavioral task
behavioral1
Sample
d38347d12101e57b4e97bf41bf33cc3803596b1d3b26e12257d29994e5756ca0.exe
Resource
win7-20220715-en
General
-
Target
d38347d12101e57b4e97bf41bf33cc3803596b1d3b26e12257d29994e5756ca0
-
Size
942KB
-
MD5
5e1e009e6d4276b63cbce7dc50f6f41c
-
SHA1
3fba19da9c47d7d2e54a52349ab4b6529ca23b23
-
SHA256
d38347d12101e57b4e97bf41bf33cc3803596b1d3b26e12257d29994e5756ca0
-
SHA512
743d1ff0d8364d6ae2476707689b1da8a69976ddcd4505d21f798b63881269c1b651dcc0bc85ce13f4d5b058e8b982142847c17e4785aaa34fd14e418ee4d67c
-
SSDEEP
12288:IK0yOVqwdjSExG5g7whricjtw3jEZeAeLNcREK8XB6kVYHH3Vdd0iOHK/paYTNY:IzZRHxGQwYci3g3BRn8RvYlXbOH4TNY
Malware Config
Signatures
-
Processes:
resource yara_rule sample themida
Files
-
d38347d12101e57b4e97bf41bf33cc3803596b1d3b26e12257d29994e5756ca0.exe windows x86
fdbfec85672f73d2a4d49635454936d4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
GetModuleHandleA
LoadLibraryA
ExitProcess
user32
MessageBoxA
Sections
Size: 44KB - Virtual size: 136KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 66KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.asddsds Size: 52KB - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Themida Size: 700KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.perplex Size: 94KB - Virtual size: 94KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE