Behavioral task
behavioral1
Sample
c04ee69d4859dae239a6f55a89ebc3ccc181559bbec2f72b46272d6dd65ad271.exe
Resource
win7-20220901-en
General
-
Target
c04ee69d4859dae239a6f55a89ebc3ccc181559bbec2f72b46272d6dd65ad271
-
Size
2.2MB
-
MD5
9b0d8b795f61f7472524745ff96ad886
-
SHA1
dbfac57f36694902a31d520f102dd0235c3729e5
-
SHA256
c04ee69d4859dae239a6f55a89ebc3ccc181559bbec2f72b46272d6dd65ad271
-
SHA512
2d1486ce1caff139f908bf05099b74d78eefda8872601da1afbef8da36101cdfd48f37a446cfa3fb9e009591aae36c8338501d3af7d3098b940ab2f456493fde
-
SSDEEP
49152:UFhW825qH16UG7elCh8civUALsBclbqJQHguIry1PRnDBRS/:UFo82qVPrPLsMbqJQsQDB
Malware Config
Signatures
-
resource yara_rule sample themida
Files
-
c04ee69d4859dae239a6f55a89ebc3ccc181559bbec2f72b46272d6dd65ad271.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 58KB - Virtual size: 144KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
rammstei Size: 246KB - Virtual size: 245KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 1024B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.themida Size: - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
roknroll Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp0 Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 246KB - Virtual size: 245KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ