Behavioral task
behavioral1
Sample
setup.exe
Resource
win7-20230621-en
General
-
Target
SIackSetupWiniso.iso
-
Size
7.3MB
-
MD5
05d8e1398832c2dbac7df6f687a0ca2b
-
SHA1
27ed48967dd5cf89fe5527a677f5763e00a46d85
-
SHA256
2cb5e093f5a3f66eb869547917b426a614d43fcde752f46de192a8f2f9602671
-
SHA512
3b4d33e7467961e7c000a7792655ba2a290e7c0e130116609961a2a453483ed6ad1d5dc0082659a35f65d5f2576db408847d6b0b3eb4bc38ce41d72a4d19bab2
-
SSDEEP
98304:VQG23fmewHtW7ZgPsy8WtNyDqmNiRMkJlSqxegWtIoZv082OQvG5N8pbso2x+x:CaQy86+iRM8EIegG/ZvhWrgj6
Malware Config
Signatures
-
Processes:
resource yara_rule static1/unpack001/setup.exe themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource unpack001/setup.exe
Files
-
SIackSetupWiniso.iso.iso
-
setup.exe.exe windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 338KB - Virtual size: 392KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 368KB - Virtual size: 367KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.themida Size: - Virtual size: 9.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 6.1MB - Virtual size: 6.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ