?GetRegisterObj@@YAPEAVIRegisterManager@@XZ
Behavioral task
behavioral1
Sample
96f550393641485e20f869bde1ded2f68c0d86971946774e7be89f73436a4310.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
96f550393641485e20f869bde1ded2f68c0d86971946774e7be89f73436a4310.dll
Resource
win10v2004-20230915-en
General
-
Target
96f550393641485e20f869bde1ded2f68c0d86971946774e7be89f73436a4310
-
Size
3.5MB
-
MD5
5a6f4832c3bb22410f836d7cc5190b90
-
SHA1
b271a3dacc9230a00bdfc68c8268797742004300
-
SHA256
96f550393641485e20f869bde1ded2f68c0d86971946774e7be89f73436a4310
-
SHA512
f784c778fb613220790ee9d6b939b05ec3b0c5b037f3ce54b7d17c95be8d349464213a88a2c7c82b5c448dd3281fea4749b549d68c528cc923644077510b7d31
-
SSDEEP
49152:gCE2uTupO5oSo4QOTaj1vTo1cHSUZXvHU8zFgSIRq84Do6iVo:gGuYS47RvTmcHz/5gSI0Do3i
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 96f550393641485e20f869bde1ded2f68c0d86971946774e7be89f73436a4310
Files
-
96f550393641485e20f869bde1ded2f68c0d86971946774e7be89f73436a4310.dll windows:5 windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Exports
Exports
Sections
Size: 136KB - Virtual size: 281KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 44KB - Virtual size: 106KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 899B - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 6KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 505B - Virtual size: 1000B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 1KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.exports Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.imports Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 3.3MB - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 16B - Virtual size: 4KB
IMAGE_SCN_MEM_READ