Behavioral task
behavioral1
Sample
3b335413e52eb3a4129e62ec346454e72737b916a6c79ca8c2c2db6240cb4844.exe
Resource
win7-20230831-en
General
-
Target
3b335413e52eb3a4129e62ec346454e72737b916a6c79ca8c2c2db6240cb4844
-
Size
3.9MB
-
MD5
2939d5d2b0ed199010615f9681a2af8d
-
SHA1
9092fb7a8443ae1813f2df4f77e858e68bce1a9a
-
SHA256
3b335413e52eb3a4129e62ec346454e72737b916a6c79ca8c2c2db6240cb4844
-
SHA512
248c4be7960edbf3a489bc062580b712f0fa3e23e916e336d2de97aa96714e9e0c16b8b6a99690df68398f6a175c590745eac70e965c6bbb235c2b81a3bde82a
-
SSDEEP
98304:jx1QSqQObFD0C7x24eGT75XaaxVmSUBMyNSr3OLm/UCjnLXioPHz:jx1vqQeFg+x24BqosSUBAdLSoPH
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3b335413e52eb3a4129e62ec346454e72737b916a6c79ca8c2c2db6240cb4844
Files
-
3b335413e52eb3a4129e62ec346454e72737b916a6c79ca8c2c2db6240cb4844.exe windows:6 windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 499KB - Virtual size: 867KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 102KB - Virtual size: 429KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 6KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 17KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 2KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 3KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 3.2MB - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ