Behavioral task
behavioral1
Sample
e1e03e3801c8ad0b00bf448a0db51fd8835fb2e7fd409d27c00bd679f79537fa.exe
Resource
win7-20230831-en
General
-
Target
e1e03e3801c8ad0b00bf448a0db51fd8835fb2e7fd409d27c00bd679f79537fa
-
Size
8.4MB
-
MD5
c355fb61bc7ffca934143b04c6864a60
-
SHA1
8cfc04f2a3412b93e5d5f1bb63d827b060ba607e
-
SHA256
e1e03e3801c8ad0b00bf448a0db51fd8835fb2e7fd409d27c00bd679f79537fa
-
SHA512
a7fc0569265d5a026611bf07ea3d852f54a501e6b4e2a464eb17c803f5e7d0f9af0f94feb00aea96f4f7f6dbae6814940033e7fcdc9b40436fe52b7c3a913214
-
SSDEEP
196608:OhAMyxvbPa5mGqEhxS3BE4+TVWwGey62zk9qnxfPf:OeRbKQ93BErBF1yJg9Sf
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e1e03e3801c8ad0b00bf448a0db51fd8835fb2e7fd409d27c00bd679f79537fa
Files
-
e1e03e3801c8ad0b00bf448a0db51fd8835fb2e7fd409d27c00bd679f79537fa.exe windows:6 windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 1.9MB - Virtual size: 4.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 374KB - Virtual size: 979KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 13KB - Virtual size: 179KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 102KB - Virtual size: 178KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 30KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.imports Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 3KB - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.themida Size: - Virtual size: 9.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 6.0MB - Virtual size: 6.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 16B - Virtual size: 4KB
IMAGE_SCN_MEM_READ