Behavioral task
behavioral1
Sample
425800c608097b71b97aa1cfce18b9cff00a7b84130a6da2b7246c189c9c6d6f.exe
Resource
win7-20231020-en
General
-
Target
425800c608097b71b97aa1cfce18b9cff00a7b84130a6da2b7246c189c9c6d6f
-
Size
3.7MB
-
MD5
ad4ff2c165d1c66aa4c71e491f1aaa7a
-
SHA1
4ee190a9de912eb642a265db4e0726a988d8852f
-
SHA256
425800c608097b71b97aa1cfce18b9cff00a7b84130a6da2b7246c189c9c6d6f
-
SHA512
7507cf2e0e47ba7b07ab832a45eec0b5246453c35aa948512f54bc3e2100051c9fd0288a73cae2f269566839bdfb5b69f9185c37bc906c6a317dc6a466f6198a
-
SSDEEP
98304:iQ8iqOFgSN74hBQxMwt/yg82XDAYEwqK1fUJx:Fq5SN74LQxMw5ygB8MqkfUJx
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 425800c608097b71b97aa1cfce18b9cff00a7b84130a6da2b7246c189c9c6d6f
Files
-
425800c608097b71b97aa1cfce18b9cff00a7b84130a6da2b7246c189c9c6d6f.exe windows:6 windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 311KB - Virtual size: 732KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 89KB - Virtual size: 267KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 446B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 19KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 436B - Virtual size: 824B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 1KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.imports Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 3.3MB - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 16B - Virtual size: 4KB
IMAGE_SCN_MEM_READ