Behavioral task
behavioral1
Sample
f45a8e04076925bd0d3990adaa82182945dad0c72d35873a108eb2cdefe29063.exe
Resource
win7-20230831-en
General
-
Target
990824b28b1db8f0e38bec6aebeaf1b2.bin
-
Size
5.1MB
-
MD5
687061b47bf902e8c2850ef395d55e74
-
SHA1
ccaa4c235aeea55d3d6763d3f016a5b1488ddded
-
SHA256
1b9b20bf3cb028faa65a0a93602711ac4402ddf4c22b3708bd9e1246b65f6cd8
-
SHA512
9be16ac460787a27e5f0c53fd30cf7bb76c90f5b918370019e3754cec33519b2f91f871c7ee5743b00dbab175794292eb6c1cfd66f98d7f269b29c4383bd550a
-
SSDEEP
98304:yXDYFEr/5s7NGfpIAk0+e7Ze2zhEIpJrNV8xzB:qVhs7NgpIAkzeIYEIpAB
Malware Config
Signatures
-
Processes:
resource yara_rule static1/unpack001/f45a8e04076925bd0d3990adaa82182945dad0c72d35873a108eb2cdefe29063.exe themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource unpack001/f45a8e04076925bd0d3990adaa82182945dad0c72d35873a108eb2cdefe29063.exe
Files
-
990824b28b1db8f0e38bec6aebeaf1b2.bin.zip
Password: infected
-
f45a8e04076925bd0d3990adaa82182945dad0c72d35873a108eb2cdefe29063.exe.exe windows x86
Password: infected
9e7ea608eaf52745b533b7e0cdbcbfde
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleA
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
ole32
CoCreateInstance
oleaut32
SysFreeString
Sections
Size: - Virtual size: 223KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zip0 Size: - Virtual size: 237KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.themida Size: - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.zip1 Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.zip2 Size: 512B - Virtual size: 444B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.zip3 Size: 5.2MB - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 81KB - Virtual size: 237KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ