Behavioral task
behavioral1
Sample
8c8fae53278d5c9f940929c418021e3eabe05267abea70274118e2750328b267.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
8c8fae53278d5c9f940929c418021e3eabe05267abea70274118e2750328b267.exe
Resource
win10v2004-20230703-en
General
-
Target
8c8fae53278d5c9f940929c418021e3eabe05267abea70274118e2750328b267
-
Size
3.8MB
-
MD5
a1538d9ffd6afde53838d211d7cd4842
-
SHA1
0fba1f642e20e61954cb6d563f3a7c15365e14bb
-
SHA256
8c8fae53278d5c9f940929c418021e3eabe05267abea70274118e2750328b267
-
SHA512
79719320c347d71cf7dd404bb1d62f99161eb043ccc9211e7d9aa71dac2170111c9c137a58374a48d9f668ac7436530954b1c2e203a0ca51b936559807381f22
-
SSDEEP
98304:/yQt2uP19g3Z16ALRQoYalJoBqV2eqZO9m9su7COJjtsFMP:/5ALGofV2diuutFQ
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8c8fae53278d5c9f940929c418021e3eabe05267abea70274118e2750328b267
Files
-
8c8fae53278d5c9f940929c418021e3eabe05267abea70274118e2750328b267.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 626KB - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 6KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 51KB - Virtual size: 246KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 315B - Virtual size: 608B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.imports Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ