Behavioral task
behavioral1
Sample
bbd256de272773ec08655837f4904473e0746498de130d04b119b0e693d3ff6c.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
bbd256de272773ec08655837f4904473e0746498de130d04b119b0e693d3ff6c.exe
Resource
win10v2004-20230703-en
General
-
Target
bbd256de272773ec08655837f4904473e0746498de130d04b119b0e693d3ff6c
-
Size
6.1MB
-
MD5
cb24a1fe75cbf5e2e21c11a9e0ec7ae4
-
SHA1
8a13d905e455646aff2743fe349e5b661c82f4c2
-
SHA256
bbd256de272773ec08655837f4904473e0746498de130d04b119b0e693d3ff6c
-
SHA512
122762d3e0cbba84fc5cb0bbd5dd10c0adab70216f337225f4b4473da5347a5da9f35898514c5dd82b6837e56f281faeb169011de9e6b6d780314a46d1ec593b
-
SSDEEP
98304:Rd6T1bXyN7TaqF4I3MyrbIXk7OQFq4FtuWPHS1dm3yLpIOum9/ZA2y:Kpbi9aqFlc2Ak7XBuWa1dUytIOum9L
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bbd256de272773ec08655837f4904473e0746498de130d04b119b0e693d3ff6c
Files
-
bbd256de272773ec08655837f4904473e0746498de130d04b119b0e693d3ff6c.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 392KB - Virtual size: 769KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 616KB - Virtual size: 667KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 32KB - Virtual size: 402KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 36KB - Virtual size: 85KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 7.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 5.0MB - Virtual size: 5.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ