Behavioral task
behavioral1
Sample
729c7829cb055679d29b496693a55814c1a493c7c4a68ab7c121ee5e4745c430.exe
Resource
win7-20230712-en
General
-
Target
8570d48a1291cc62a902b06b7429b2dd.bin
-
Size
3.2MB
-
MD5
074a8132267a3dccdf90b8e2a1250220
-
SHA1
061895d53fc8f2d6791ca966dbdbe6ba93c2360e
-
SHA256
d02c1cf4849f47e5fccc5df452d4f90b28caa0cfd0430e3c998d43bd457da860
-
SHA512
5a4994946730736bd89066e01a84b1efadc3656b7249b97ddb1bd6fbd0535b535eaeb0d5e90f7775935716551f846a032020ff3ce1951b59a300a901d5dadc47
-
SSDEEP
49152:K8K7At0Ln+foLlmh5YbFDlSvhkpbCXMujHC9Mw7iNkHSIkFtNn/exZdZ:I7tLLDBDlUWYMuAM4iimr/2ZdZ
Malware Config
Signatures
-
resource yara_rule static1/unpack001/729c7829cb055679d29b496693a55814c1a493c7c4a68ab7c121ee5e4745c430.bin themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/729c7829cb055679d29b496693a55814c1a493c7c4a68ab7c121ee5e4745c430.bin
Files
-
8570d48a1291cc62a902b06b7429b2dd.bin.zip
Password: infected
-
729c7829cb055679d29b496693a55814c1a493c7c4a68ab7c121ee5e4745c430.bin.exe windows x86
Password: infected
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 592KB - Virtual size: 600KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.themida Size: 5.5MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE