Behavioral task
behavioral1
Sample
gqzWLuj.exe
Resource
win7-20230621-en
General
-
Target
gqzWLuj.exe
-
Size
7.3MB
-
MD5
1e66c8ef1875a529037619948c688c76
-
SHA1
6e3dea3ea0bbabc3c50505602ad134ed4cbba64b
-
SHA256
bdd020e88a103385ba9de61b537b642fa8ac9b429633e7a7018f72e269f6eb20
-
SHA512
2af83cf534460d2e00c1426f0824f22be44bab98d602ac7464818bfa322ae57a55f0bf79b807ccfe46fdc602fd603fbef0c1c58230a94ea1adf2fbc387b3bef3
-
SSDEEP
196608:Cf++daPK3dXn6VZQPdQPD4Y2CBCWixgLl1RCb:ZHQ+D4Y2C4WwU1RA
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource gqzWLuj.exe
Files
-
gqzWLuj.exe.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 917KB - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 1.8MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 11KB - Virtual size: 134KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 433KB - Virtual size: 432KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 76KB - Virtual size: 124KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.themida Size: 4.1MB - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 16B - Virtual size: 4KB
IMAGE_SCN_MEM_READ