Behavioral task
behavioral1
Sample
d6fa2c389d4227b3fed250e7fc481a0de73b11435097901c878afd06f798e990.exe
Resource
win7-20230831-en
General
-
Target
d6fa2c389d4227b3fed250e7fc481a0de73b11435097901c878afd06f798e990
-
Size
5.7MB
-
MD5
618a8671023ca11a57858b6b5f541b4d
-
SHA1
a3f670f459282173a1a348fb0ca726f21f84e303
-
SHA256
d6fa2c389d4227b3fed250e7fc481a0de73b11435097901c878afd06f798e990
-
SHA512
2d494b50bc89fd88b3d29f16aec1cbd3b9162f30cfd553febaec598ec148901f528c5ba729ec29bafd585c18102b63471128f5e3b380f9b17bd6f271ec7ff354
-
SSDEEP
98304:1a+2vXTcQ5ZJyUdGq8aYHU2wHQFNeIxIz17c8hnU7D4O2D4DsFv9Q:M+2bdypZHMHQFNxxEzU7EO2DlFS
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d6fa2c389d4227b3fed250e7fc481a0de73b11435097901c878afd06f798e990
Files
-
d6fa2c389d4227b3fed250e7fc481a0de73b11435097901c878afd06f798e990.exe windows:4 windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 492KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 1.3MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 29KB - Virtual size: 386KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 8KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.imports Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 5.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 3.8MB - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ