Behavioral task
behavioral1
Sample
41001a1557a063068e85bced1e96e6f28e9ef670b967185ff5e031889c592e18.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
41001a1557a063068e85bced1e96e6f28e9ef670b967185ff5e031889c592e18.exe
Resource
win10v2004-20230703-en
General
-
Target
41001a1557a063068e85bced1e96e6f28e9ef670b967185ff5e031889c592e18
-
Size
6.3MB
-
MD5
913b2879501f39988de9a93d46cfe127
-
SHA1
1a7bc3dc1e9f8612f0fd7bbc3fb12b0582d9815f
-
SHA256
41001a1557a063068e85bced1e96e6f28e9ef670b967185ff5e031889c592e18
-
SHA512
817a2f01db84e7d0d0597ed1b98a15b51de4fa45e80d8fdffab476111ad6718df08bad10214e1d882ef83e47db4bf1c755ef69374b6e5962489bc1ffe91ba3a5
-
SSDEEP
98304:nFqfU9I7BzM5MCGLGWY4MAkOLBOcli4/sYxpFh3fNZC8Wg246U3BX9DGlL2CdGzU:nwcSh8AylVQ1OGF/FZfNA8sQeC388g
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 41001a1557a063068e85bced1e96e6f28e9ef670b967185ff5e031889c592e18
Files
-
41001a1557a063068e85bced1e96e6f28e9ef670b967185ff5e031889c592e18.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 392KB - Virtual size: 754KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 616KB - Virtual size: 663KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 32KB - Virtual size: 402KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 36KB - Virtual size: 85KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 7.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 5.1MB - Virtual size: 5.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ