Behavioral task
behavioral1
Sample
c95439f82d176b8f72b0edbb7542deae7b56430e98604e98a1c947c576180bce.exe
Resource
win7-20231023-en
General
-
Target
c95439f82d176b8f72b0edbb7542deae7b56430e98604e98a1c947c576180bce
-
Size
7.5MB
-
MD5
df0f429ef462002aab684018956a964f
-
SHA1
2bb0acef460dbad29a670d800dc009a3a37a1db2
-
SHA256
c95439f82d176b8f72b0edbb7542deae7b56430e98604e98a1c947c576180bce
-
SHA512
aace73102573ac68b086349ab5fbb2fcaaa9e8427ce0110c7ab48d0972321489a023af6b0d0e8760fdaf5e4459dd65db37a87476465999f47834cbf8abaf9c8d
-
SSDEEP
196608:iTlyLR67q56TFfcALme8zbWPrSUOt4H6cerYt3d9krl1O7np:yyL8+e/8zCTdJacero9iM
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c95439f82d176b8f72b0edbb7542deae7b56430e98604e98a1c947c576180bce
Files
-
c95439f82d176b8f72b0edbb7542deae7b56430e98604e98a1c947c576180bce.exe windows:4 windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 660KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4.1MB - Virtual size: 7.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 40KB - Virtual size: 411KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 28KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 100KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ