Behavioral task
behavioral1
Sample
4867822a4f3b6a5863c1a3e407ca09aae29fed5be1e4fb6bdce6f25432d329dc.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
4867822a4f3b6a5863c1a3e407ca09aae29fed5be1e4fb6bdce6f25432d329dc.exe
Resource
win10v2004-20220721-en
General
-
Target
4867822a4f3b6a5863c1a3e407ca09aae29fed5be1e4fb6bdce6f25432d329dc
-
Size
3.2MB
-
MD5
b8233187f084143727b167f9d244902f
-
SHA1
d793053d6d50c5d3c1897d44c984430cbcee0c51
-
SHA256
bf263a7c032656cfc2b0fceaad7640f2665f5736c3b456d002c26d674658cac6
-
SHA512
8ca2eb3ca6644863e149dc5da4aa26e47caf05a840a8b4ee417c31dc8ab6981457f480c9e2ca7b746d68c2b9b9a531f285bc4195e83fb559739540b9ed49f838
-
SSDEEP
98304:HBVY63wfBvY+RY2eGmXsTo3lEIuKZWtzdbA35o41U0:X13wfBRY27ZTBdKQtzNio4+0
Malware Config
Signatures
-
Processes:
resource yara_rule sample themida
Files
-
4867822a4f3b6a5863c1a3e407ca09aae29fed5be1e4fb6bdce6f25432d329dc.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 18KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 1KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 127KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ndata Size: - Virtual size: 244KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3.6MB - Virtual size: 3.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 145KB - Virtual size: 145KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE