Behavioral task
behavioral1
Sample
e987a50d62a108678d4a1f9f22a66c3cf6769cb71c10194e4d98c37901672bb2.exe
Resource
win7-20230712-en
General
-
Target
e987a50d62a108678d4a1f9f22a66c3cf6769cb71c10194e4d98c37901672bb2
-
Size
3.8MB
-
MD5
8d8c5952e3de74da07cf5f1910480684
-
SHA1
118e9d6811d65ecd230b497cf680e572e3b6f2ab
-
SHA256
e987a50d62a108678d4a1f9f22a66c3cf6769cb71c10194e4d98c37901672bb2
-
SHA512
4570d47990ca48b87fb26a4de8f0f4b2f2f8f901ec010605c4bba4cf81fb024a331fcef3e3dc5633aea2063b9e19f8199cf117f1488ebab2db4eef158fe8ae2e
-
SSDEEP
98304:cV5TdMJjLJbKtYKUPwWW3s+CSjmLLGyswrmgIT79:2MJjLPKUPzW3s+UFHyh
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e987a50d62a108678d4a1f9f22a66c3cf6769cb71c10194e4d98c37901672bb2
Files
-
e987a50d62a108678d4a1f9f22a66c3cf6769cb71c10194e4d98c37901672bb2.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 387KB - Virtual size: 772KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 663KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 28KB - Virtual size: 395KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 19KB - Virtual size: 442KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.imports Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 428KB - Virtual size: 428KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 3.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ