Behavioral task
behavioral1
Sample
02492b38ad640ae63478907356e86eb79d44fd906453f17ad872d6a16c23adb9.exe
Resource
win7-20230824-en
Behavioral task
behavioral2
Sample
02492b38ad640ae63478907356e86eb79d44fd906453f17ad872d6a16c23adb9.exe
Resource
win10v2004-20230703-en
General
-
Target
02492b38ad640ae63478907356e86eb79d44fd906453f17ad872d6a16c23adb9
-
Size
6.1MB
-
MD5
98d9859f2f028c7d20575e4889c9f33f
-
SHA1
33d407928bba4a1dd639236f6adf1d6cf0c0f80a
-
SHA256
02492b38ad640ae63478907356e86eb79d44fd906453f17ad872d6a16c23adb9
-
SHA512
46e503adbfa04f9eae06fd19b20aa01133fed9c47493a87766d341a83cbefd8ffafeacf1c3918c0f6ee026da0c99cd9a9ace42837d0d8414d92da7213d41e211
-
SSDEEP
98304:O2U6jna/FSF8t+IzQkviin79v/by+J2g/dsEOxYoM9/4pt+7kkf1eAWyJKCA:O2UeCAFzZkN79HJ2aCEOxYoMve1C
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 02492b38ad640ae63478907356e86eb79d44fd906453f17ad872d6a16c23adb9
Files
-
02492b38ad640ae63478907356e86eb79d44fd906453f17ad872d6a16c23adb9.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 392KB - Virtual size: 754KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 616KB - Virtual size: 663KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 32KB - Virtual size: 402KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 36KB - Virtual size: 85KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 7.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 5.0MB - Virtual size: 5.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ