Behavioral task
behavioral1
Sample
b156409f4fce371d73516dd46ea70166869f96ae8422d51389376cea77f51643.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
b156409f4fce371d73516dd46ea70166869f96ae8422d51389376cea77f51643.exe
Resource
win10v2004-20220721-en
General
-
Target
b156409f4fce371d73516dd46ea70166869f96ae8422d51389376cea77f51643
-
Size
4.3MB
-
MD5
d31a8aaa2e3d354abb6d862c2bf8e5bd
-
SHA1
a0e63cdfdc0e044ee77ad689329a1ff01a450dc8
-
SHA256
202d8cd81425760d521bbec6d67370bcc95f164cd10afefacf90dc4f12dbbc3e
-
SHA512
c7be2848f6e5a58d3e2eb1fa551a56232aedb4b02e618e896db10b49c027a6fbdf34e7d5f48af09faebfe24bff461ad6c1356cf05b5f6a9e61a8d29f7e88f580
-
SSDEEP
98304:nXi0OC7TPyRvPYR2VESy/ASe9PZsv+Yke:nXrOC7TPyRH1ySy/ASt
Malware Config
Signatures
-
Processes:
resource yara_rule sample themida
Files
-
b156409f4fce371d73516dd46ea70166869f96ae8422d51389376cea77f51643.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 18KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 1KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 127KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ndata Size: - Virtual size: 244KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3.6MB - Virtual size: 3.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 145KB - Virtual size: 145KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE