Behavioral task
behavioral1
Sample
1148-55-0x0000000000F60000-0x00000000017B2000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1148-55-0x0000000000F60000-0x00000000017B2000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
1148-55-0x0000000000F60000-0x00000000017B2000-memory.dmp
-
Size
8.3MB
-
MD5
e53958ea32586293eeecd4f27e703e21
-
SHA1
e547b47a72ffe0cbf74af00d6fe587f76479e95e
-
SHA256
42e12432fdda626360001734b28b3c4a9fda941a2a313519a089c538c3c7e7cc
-
SHA512
4664f47a6b818b5325a5565989ad5740ab8e5ed050796bed24219bd8a0fa0f11d0d5b1adf438ca09fa40f26a63c6112379422374ee05cb5e530cd0cf8b620613
-
SSDEEP
98304:KhdvvtSdd0zlR0AxzQi5C6//u+TDIPGjiIKwLDrG9kG9bHpNSFwdUEcNCdkkBQE0:n6//pqGjLKEUB5vsw0N0BTE
Malware Config
Signatures
-
Privateloader family
-
resource yara_rule sample themida
Files
-
1148-55-0x0000000000F60000-0x00000000017B2000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 543KB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 76KB - Virtual size: 164KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 11KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1.2MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 16KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 228KB - Virtual size: 228KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: 3.9MB - Virtual size: 3.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 16B - Virtual size: 4KB
IMAGE_SCN_MEM_READ