Behavioral task
behavioral1
Sample
04ad765456a5977ceb716749aa05ca044dc70e08f9511bce89fa965955cd8a3c.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
04ad765456a5977ceb716749aa05ca044dc70e08f9511bce89fa965955cd8a3c.exe
Resource
win10v2004-20230703-en
General
-
Target
04ad765456a5977ceb716749aa05ca044dc70e08f9511bce89fa965955cd8a3c
-
Size
8.3MB
-
MD5
044abb1b01decc62236a709c460639bd
-
SHA1
d37907613f246bc521d4e85fe902abd556100c33
-
SHA256
04ad765456a5977ceb716749aa05ca044dc70e08f9511bce89fa965955cd8a3c
-
SHA512
2635ba4a2965db3cf25fbed50f8be9a457f25e280ee9d1a09294121603740e368be90b770fff0e515d72f27a00fa78b7dd31e8f6e776ad92347ce5588674e99e
-
SSDEEP
196608:/rUyCyNaGC4yzXaraD6PyFHu26+tO/H8HnbPLlBCrtuhF1y/:/Qypz3KXD6P4DOfGbzertuNQ
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 04ad765456a5977ceb716749aa05ca044dc70e08f9511bce89fa965955cd8a3c
Files
-
04ad765456a5977ceb716749aa05ca044dc70e08f9511bce89fa965955cd8a3c.exe windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 1.9MB - Virtual size: 4.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 374KB - Virtual size: 979KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 13KB - Virtual size: 179KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 102KB - Virtual size: 178KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 30KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.imports Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 3KB - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.themida Size: - Virtual size: 9.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 5.8MB - Virtual size: 5.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 16B - Virtual size: 4KB
IMAGE_SCN_MEM_READ