Behavioral task
behavioral1
Sample
2c22cd313838ce8bef3f54b33a1c09f07e2b1728a9f5d00af8cd571728a4501e.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
2c22cd313838ce8bef3f54b33a1c09f07e2b1728a9f5d00af8cd571728a4501e.exe
Resource
win10v2004-20231023-en
General
-
Target
2c22cd313838ce8bef3f54b33a1c09f07e2b1728a9f5d00af8cd571728a4501e
-
Size
2.7MB
-
MD5
e69265e07618e3cdb39a73a258998044
-
SHA1
4083f989e377a3083e93b1eeb33cc52994409759
-
SHA256
2c22cd313838ce8bef3f54b33a1c09f07e2b1728a9f5d00af8cd571728a4501e
-
SHA512
3432d4e1d60caf26f06a080cd68971ac2a6862530812cdebf041e5b284a178634ca7facab3c9a3254e534b00cc16b985c05009fcc164576bcb97949a9ceb49b9
-
SSDEEP
49152:ycVDlkIoqaydRIMQm5q+38shTnKMIl/D+ZpMOndq7KKTi/S4:5FlklEdXjbnKMm/DFGKyS4
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2c22cd313838ce8bef3f54b33a1c09f07e2b1728a9f5d00af8cd571728a4501e
Files
-
2c22cd313838ce8bef3f54b33a1c09f07e2b1728a9f5d00af8cd571728a4501e.exe windows:4 windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 70KB - Virtual size: 230KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 5KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 3KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 47KB - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.imports Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ