Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20221111-en
General
-
Target
file.exe
-
Size
2.2MB
-
MD5
ee3ba1a2e0580b39ebac49262cc23de2
-
SHA1
3a4f8c2808bd7e1a021a2c782c28fd2e8f51d778
-
SHA256
e98ce8068cae82b111f1e99142f30b1e57701e80dc5fad998aba21b6b34fd233
-
SHA512
4655cef48f7b3d5e08d972e51f46aa8fbe427a48cd1e918b7c7516e5d8d2073adbe715673b8908c1cd397a46d2f8d6b20635753ebf64c30acedd9312b19a9bbf
-
SSDEEP
49152:ntaa55b+xYm20g/LnFeWWN2DNS60Z9qjtOfRN63FrDhZtn:taamYmw/LnFeXoSzZ9qjAfRN6FvhZN
Malware Config
Signatures
-
Processes:
resource yara_rule sample themida
Files
-
file.exe.exe windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 503KB - Virtual size: 720KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 19KB - Virtual size: 95KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 96KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ