Behavioral task
behavioral1
Sample
cd8ad05861492c508a2fc9c091f8d82c8fe2147973897face99783382b6c10a2.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
cd8ad05861492c508a2fc9c091f8d82c8fe2147973897face99783382b6c10a2.exe
Resource
win10v2004-20230915-en
General
-
Target
cd8ad05861492c508a2fc9c091f8d82c8fe2147973897face99783382b6c10a2
-
Size
2.3MB
-
MD5
826e82088518ee87d2a29f4fb4881477
-
SHA1
ce863fb19348277e2ed6aa73ad7a09224f86929e
-
SHA256
cd8ad05861492c508a2fc9c091f8d82c8fe2147973897face99783382b6c10a2
-
SHA512
1d31ca6560a1017cb186b585eb0d10c48b40b6662d9ca54141f4ccfd0487eeae79bc92e1a26cd0d86e700c6fbffbab33b34411d9ed4965aefe0027ad74474614
-
SSDEEP
49152:SM4PKS0dGl+O5CsRin6cO3IK6P4+osUjBjicdLd866j9MT:vFfGlfihUJ6gHsUdVdh86gaT
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cd8ad05861492c508a2fc9c091f8d82c8fe2147973897face99783382b6c10a2
Files
-
cd8ad05861492c508a2fc9c091f8d82c8fe2147973897face99783382b6c10a2.exe windows:4 windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 436KB - Virtual size: 924KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 632KB - Virtual size: 692KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 28KB - Virtual size: 262KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 20KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 52KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 7.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 4.6MB - Virtual size: 4.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ