General
-
Target
e388f58cb819d7d603ab71b8909a439ee9e4ac1630c7c64386112a75f2e60966.zip
-
Size
14.0MB
-
MD5
5782acae1486d127c97add9a064b41e8
-
SHA1
bf7704e3e5b9d7f88985d4ddaf1d06dc4818863a
-
SHA256
4fa6460b98e2dc3907cf0ddbf0b56810d0bf48180aa56dd709d4d8c07309d5f7
-
SHA512
9766839cd0feed0b95675d978f78b10b25e9027e81468c4774544b1260a40dac94b1a9d4b8a6c9b366eb010f510bb2e25ade49b9fb113f3dd8efa2ee2cb1ce10
-
SSDEEP
393216:/dxkZwUrNNgtZkGmsOB0ZUM1lkoC5UMSKeii:1bSQBOiZUMoNSZx
Malware Config
Signatures
-
resource yara_rule static1/unpack001/e388f58cb819d7d603ab71b8909a439ee9e4ac1630c7c64386112a75f2e60966.exe themida
Files
-
e388f58cb819d7d603ab71b8909a439ee9e4ac1630c7c64386112a75f2e60966.zip.zip
Password: infected
-
e388f58cb819d7d603ab71b8909a439ee9e4ac1630c7c64386112a75f2e60966.exe.exe windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 891KB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 70KB - Virtual size: 163KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 23KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 1KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 34KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 20.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 13.0MB - Virtual size: 13.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ