Behavioral task
behavioral1
Sample
d15472f976934444038ad2d5dbd31b5627c8738bf10cea91c5f2f89827c644ec.exe
Resource
win7-20230220-en
General
-
Target
51e2849762ef9e1e0221b383c71d6b25.bin
-
Size
4.1MB
-
MD5
b1ed32344f8b62b5b4bb8f049d1faa61
-
SHA1
ad318f09c5ec19f869e36a2b8614fdbabc4227f9
-
SHA256
e5470adbed02c34c34011b783e5a8dadd37412eff389886e86decf4adb026b5d
-
SHA512
9f2394611715ba299eb27522a7924f09cb61f0989c3c6bff7ac0c03f228d29f22e56f5ae587997fdbbbd8619b33b9b751eec7bc97bbd8ab8a37e1dff437e343d
-
SSDEEP
98304:knpf5fU7JZFkZZRJWgp+CeL0O2UwlBZ8ZQNmexY3xN5mX:i5fU7JPkZZRJdp+CA05UC/xY3xN5mX
Malware Config
Signatures
-
resource yara_rule static1/unpack001/d15472f976934444038ad2d5dbd31b5627c8738bf10cea91c5f2f89827c644ec.exe themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/d15472f976934444038ad2d5dbd31b5627c8738bf10cea91c5f2f89827c644ec.exe
Files
-
51e2849762ef9e1e0221b383c71d6b25.bin.zip
Password: infected
-
d15472f976934444038ad2d5dbd31b5627c8738bf10cea91c5f2f89827c644ec.exe.exe windows x86
Password: infected
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 57KB - Virtual size: 136KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 19KB - Virtual size: 403KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 15B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.imports Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 366KB - Virtual size: 366KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 4.0MB - Virtual size: 4.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ