Behavioral task
behavioral1
Sample
64544.exe
Resource
win7-20230220-en
General
-
Target
64544.exe
-
Size
3.8MB
-
MD5
64a9ca23ce381b557a39ec25516115dd
-
SHA1
19742ca6ebd32e9755021530805ad3906baffad3
-
SHA256
c967a2670c98153465b35844d7fb481ebf3b44ecf66bde7a7c4541d6e3b99e28
-
SHA512
499b180d602e2dbc0ea8a4b7a203dd8fbf69b0f5ea291c97862b3bcd31e4177dede32b0aa483b95a1601af53424ea06e1af24805f7f594994943e2f4c61444d9
-
SSDEEP
49152:iLDYlAuLibTacTvl5nGR+S5P9b+F2HNFuqagTLVjdWgsIC86MVRRX8R1c5sZg9Ef:iLDYljcTBGHSqjtp+etsR1xg/EC01
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 64544.exe
Files
-
64544.exe.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 1.2MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.themida Size: - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ