Behavioral task
behavioral1
Sample
unpacked_ldr.exe
Resource
win7-20230220-en
General
-
Target
unpacked_ldr.exe
-
Size
12.8MB
-
MD5
1c8580175881dc6530e70ca9ee1964aa
-
SHA1
148bb471cff497bc21d5e1d62c2d96eee7065d08
-
SHA256
a6e45ae60e5964995aae909bdd375f28616ea6f1e956a997d1ff6a1068c20ad2
-
SHA512
ad7c0a8554bdb582e5658dbd2700788c0b0a33f6ece04e2035be9ea4d07d77b7bfc38ea5d2c97217af8df33295cc0db6fa25ecaca8affc18eb6201cd62444894
-
SSDEEP
196608:OYRexuBNWzYqrWwjeXnzvroec4eLQQBwNh9aaDb:OYRvBNBqSZEee8Qabka
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpacked_ldr.exe
Files
-
unpacked_ldr.exe.exe windows x64
3330ef11f0c34a6ea2536615a1177221
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
advapi32
CryptReleaseContext
GetTokenInformation
GetLengthSid
OpenProcessToken
IsValidSid
CopySid
ConvertSidToStringSidA
CryptAcquireContextA
CryptGetHashParam
CryptGenRandom
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptEncrypt
crypt32
CertGetCertificateChain
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CertFreeCertificateChainEngine
CryptStringToBinaryA
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertCreateCertificateChainEngine
CertFreeCertificateChain
gdi32
GetDeviceCaps
imm32
ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow
kernel32
SetEvent
InitializeCriticalSectionAndSpinCount
WaitForMultipleObjects
PeekNamedPipe
GetFileType
GetStdHandle
GetEnvironmentVariableA
WaitForSingleObjectEx
CreateEventW
GetTickCount
VerifyVersionInfoA
GetSystemDirectoryA
GetModuleHandleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
QueryPerformanceCounter
VerifyVersionInfoW
FreeLibrary
VerSetConditionMask
GetProcAddress
QueryPerformanceFrequency
LoadLibraryA
GetModuleHandleA
GlobalUnWire
WideCharToMultiByte
GlobalLock
GlobalFree
CreateFileA
GetFileSizeEx
ReadFile
CloseHandle
HeapAlloc
HeapReAlloc
HeapFree
GetProcessHeap
Sleep
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
GetModuleFileNameA
GetCurrentProcess
InitializeCriticalSectionEx
HeapSize
GetLastError
CreateThread
HeapDestroy
DeleteCriticalSection
WinExec
LocalFree
SetLastError
FormatMessageA
ResetEvent
GlobalAlloc
MultiByteToWideChar
MoveFileExA
EnterCriticalSection
LeaveCriticalSection
SleepEx
msvcp140
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Xbad_function_call@std@@YAXXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
??Bid@locale@std@@QEAA_KXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?good@ios_base@std@@QEBA_NXZ
?flags@ios_base@std@@QEBAHXZ
?width@ios_base@std@@QEBA_JXZ
?width@ios_base@std@@QEAA_J_J@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?uncaught_exceptions@std@@YAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?do_encoding@?$codecvt@_SDU_Mbstatet@@@std@@MEBAHXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
normaliz
IdnToAscii
psapi
GetModuleInformation
shell32
ShellExecuteA
user32
DestroyWindow
LoadCursorA
SetWindowTextW
GetKeyState
WindowFromPoint
ShowWindow
GetCapture
SetWindowLongA
AdjustWindowRectEx
ClientToScreen
GetWindowLongW
IsChild
GetMonitorInfoA
PeekMessageA
TranslateMessage
GetForegroundWindow
DefWindowProcA
DispatchMessageA
ScreenToClient
CreateWindowExA
SetLayeredWindowAttributes
EnumDisplayMonitors
MonitorFromWindow
SetFocus
BringWindowToTop
SetCapture
SetCursor
MessageBoxA
SetWindowLongW
UnregisterClassA
RegisterClassExA
ReleaseCapture
SetForegroundWindow
IsIconic
SetCursorPos
ReleaseDC
GetCursorPos
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
GetWindowRect
GetDesktopWindow
GetDC
SetWindowPos
GetClientRect
userenv
UnloadUserProfile
vcruntime140
memcpy
__std_terminate
__std_exception_destroy
__std_exception_copy
strstr
strchr
strrchr
longjmp
_CxxThrowException
memcpy
__intrinsic_setjmp
__current_exception_context
__current_exception
__C_specific_handler
memcmp
memchr
memset
vcruntime140_1
__CxxFrameHandler4
wldap32
ldap_msgfree
ldap_search_sA
ldap_bind_sA
ldap_first_entry
ldap_next_entry
ldap_first_attributeA
ber_free
ldap_simple_bind_sA
ldap_next_attributeA
ldap_set_optionA
ldap_unbind_s
ldap_value_free_len
ldap_memfreeA
ldap_get_dnA
ldap_get_values_lenA
ldap_initA
ldap_sslinitA
ldap_err2stringA
ws2_32
WSAGetLastError
bind
connect
getpeername
send
closesocket
getsockname
getsockopt
htons
htons
htonl
gethostname
sendto
recvfrom
FreeAddrInfoW
getaddrinfo
select
__WSAFDIsSet
ioctlsocket
listen
htonl
accept
WSACleanup
WSAStartup
WSAIoctl
WSASetLastError
socket
setsockopt
recv
ucrtbase
strtoul
_strtoui64
atoi
_strtoi64
strtol
strtod
_unlock_file
_lock_file
remove
_fstat64
_stat64
_unlink
_access
free
_callnewh
realloc
malloc
calloc
_set_new_mode
_configthreadlocale
localeconv
floor
_dclass
acosf
ceilf
fmodf
sinf
sqrtf
pow
__setusermatherr
cosf
exit
_invalid_parameter_noinfo_noreturn
_errno
strerror
abort
_resetstkoflw
_invalid_parameter_noinfo
__sys_nerr
_beginthreadex
_getpid
_register_thread_local_exe_atexit_callback
_c_exit
_configure_narrow_argv
_Exit
_initterm_e
_initterm
_get_narrow_winmain_command_line
_set_app_type
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_seh_filter_exe
terminate
_cexit
fputc
fflush
fclose
_set_fmode
setvbuf
ungetc
fsetpos
__p__commode
_lseeki64
fread
_fseeki64
fwrite
feof
_get_stream_buffer_pointers
_read
_write
_close
_open
_popen
fgets
_pclose
fgetc
__stdio_common_vfprintf
ftell
fopen
fputs
__acrt_iob_func
fseek
__stdio_common_vsscanf
__stdio_common_vsprintf
_wfopen
fgetpos
strcmp
strncpy
strcpy_s
tolower
strpbrk
_mbsdup
strcspn
strspn
isupper
strncmp
_gmtime64
_time64
strftime
_localtime64_s
qsort
d3d9
Direct3DCreate9
Sections
.text Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 435KB - Virtual size: 444KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 7KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 57KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.imports Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: 6.8MB - Virtual size: 6.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 4.2MB - Virtual size: 4.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.SCY Size: 11KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE