LdrProcessRelocationBlock
StealthCloseFile
StealthGetSize
StealthOpenFile
StealthReadFile
Behavioral task
behavioral1
Sample
cfde1ee913cfdad570669a3272a2a25b1d6c6f020b4314e27c4c5f60a8a8de3e.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
cfde1ee913cfdad570669a3272a2a25b1d6c6f020b4314e27c4c5f60a8a8de3e.exe
Resource
win10v2004-20230915-en
Target
cfde1ee913cfdad570669a3272a2a25b1d6c6f020b4314e27c4c5f60a8a8de3e
Size
6.5MB
MD5
1c1d5fe9470618630b6b3fdb4ad4b9f1
SHA1
ece4bc542cb58ed9c74666eac8ca4517e48800a1
SHA256
cfde1ee913cfdad570669a3272a2a25b1d6c6f020b4314e27c4c5f60a8a8de3e
SHA512
7517649e7e10f261eb57ab3dd56a28af3f1a20ee1efb9b7d7a037fe8e526602cbac4b050b43c6ef5c6b375736b23071754aad1a6977b73ee9ed46c9818e2b5df
SSDEEP
98304:lskfRnxhAd9tfln5pWjDydJ3DQWbnhJ1/PGCoxBaE+XvRPDakHmV+nT3xMnuE41i:nzI9NsjDydJ3D9hzeMR7akGVcqa+n
resource | yara_rule |
---|---|
sample | themida |
Checks for missing Authenticode signature.
resource |
---|
cfde1ee913cfdad570669a3272a2a25b1d6c6f020b4314e27c4c5f60a8a8de3e |
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
LdrProcessRelocationBlock
StealthCloseFile
StealthGetSize
StealthOpenFile
StealthReadFile
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_READ