Behavioral task
behavioral1
Sample
4b56cedeff6446e9b91f374f4a06e3bafd951005acef67469bfc693a68a30bff.exe
Resource
win7-20230824-en
General
-
Target
4b56cedeff6446e9b91f374f4a06e3bafd951005acef67469bfc693a68a30bff
-
Size
2.4MB
-
MD5
d8ed9bd2d848a21fc638bfecb5c56b0c
-
SHA1
3853a7e2c75425806e815fec2b1c5b686c722f12
-
SHA256
4b56cedeff6446e9b91f374f4a06e3bafd951005acef67469bfc693a68a30bff
-
SHA512
8cc6c5200c7869e305c8ff336461ac50475b713602b3d454529d439195e6eabc5b3d2fda8d41dee804c0e23f4080fdc5f4aba7e4a8c95b7c730398f6d7654cb9
-
SSDEEP
49152:EL74DifSDM1BxDHn7svQ6LRvV2a6XBM61qDJBI7WcD41NXK9vOD/KBa0:EL70afH7Y3LRMaEqQ73DSsvmiBa
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4b56cedeff6446e9b91f374f4a06e3bafd951005acef67469bfc693a68a30bff
Files
-
4b56cedeff6446e9b91f374f4a06e3bafd951005acef67469bfc693a68a30bff.exe windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 269KB - Virtual size: 472KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 157KB - Virtual size: 249KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 120KB - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ