Behavioral task
behavioral1
Sample
02785bce9e33a4ef756d96e80b1c1297c951af81d13f9a65609f39ff10c6bdc0.exe
Resource
win7-20230831-en
General
-
Target
02785bce9e33a4ef756d96e80b1c1297c951af81d13f9a65609f39ff10c6bdc0
-
Size
6.6MB
-
MD5
1598af4e1abf92edf3bc7a366b0d82f8
-
SHA1
d7aa6b4ea025fceb4f80185152f9ac63df38d509
-
SHA256
02785bce9e33a4ef756d96e80b1c1297c951af81d13f9a65609f39ff10c6bdc0
-
SHA512
bf8a0c7825f9945dd09272eb1cf06b1938f58a371a841468c15f02fd8bb7fbdcece8767fe78899c6e71a341e03caad3a18227bcac30e28a157021328abfcee33
-
SSDEEP
196608:hVLEmirnLtSO8RL4P1MIZpImv/rHQy/njOJJ0:hxiNuZEIm7pyJJ0
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 02785bce9e33a4ef756d96e80b1c1297c951af81d13f9a65609f39ff10c6bdc0
Files
-
02785bce9e33a4ef756d96e80b1c1297c951af81d13f9a65609f39ff10c6bdc0.exe windows:4 windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 664KB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 13KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 2.0MB - Virtual size: 3.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 29KB - Virtual size: 85KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 86KB - Virtual size: 86KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 5.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 3.8MB - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ