Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7-20230220-en
General
-
Target
Setup.zip
-
Size
11.7MB
-
MD5
fc132bc11e3b04630ccf796597d0afbb
-
SHA1
5afead39f8807ca8817487c76405362c75ad133e
-
SHA256
f387a8332e1765f0cd71cb73aad027dea840436e6879cdbd103ee19cc04a1b81
-
SHA512
575cf4b11fe904a4c45af276400f1b853d444b9df91ee88afb135c6ae81b1a291c029cb8af871285ef9df559ce4ada24612f93f5c5fb065abaddfc4262215e11
-
SSDEEP
49152:Z0zuzLyZTDGcUiIOy0LzH44VhGUnNvYWgiTgPYC8Fpy9LpjPQgDg3:ZWuzOGRV4LnNvYC0PYCTjPQgy
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Setup.exe themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Setup.exe
Files
-
Setup.zip.zip
-
Setup.exe.exe windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 892KB - Virtual size: 896KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 122KB - Virtual size: 163KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 163KB - Virtual size: 163KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: 3.5MB - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE