Behavioral task
behavioral1
Sample
aa2ec7e92bfa5b35348bcf635e7811c4e8f01ef8bd3888997cf559d1b0e72fc4.exe
Resource
win7-20231020-en
General
-
Target
aa2ec7e92bfa5b35348bcf635e7811c4e8f01ef8bd3888997cf559d1b0e72fc4
-
Size
5.7MB
-
MD5
a6d0999d10c4d3a1aee18d73693a5b13
-
SHA1
298d75d1850f7596991aa739fd73738982792442
-
SHA256
aa2ec7e92bfa5b35348bcf635e7811c4e8f01ef8bd3888997cf559d1b0e72fc4
-
SHA512
f5e1e976f7e7a561081297c293d11c06ae471d90d0df167fc57c581cb4cb6b2b5d31f7a8c413de058e9f924b55a9a44c338c6c054ee0947f87dfd59d6b6c3348
-
SSDEEP
98304:9BALWhkuHRdKG2B746zHzhEgNgqVpbTYVgZoj47MZ5FV0ZIvY4mQj1zvJoBeTPRZ:9mahkuHRl2jzGgNvpbXZ778hsIvY6j1R
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource aa2ec7e92bfa5b35348bcf635e7811c4e8f01ef8bd3888997cf559d1b0e72fc4
Files
-
aa2ec7e92bfa5b35348bcf635e7811c4e8f01ef8bd3888997cf559d1b0e72fc4.exe windows:6 windows x86 arch:x86
4606041c7eb9dc2ea0c018ff25cd5fa6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleA
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetClipboardData
advapi32
RegSetValueExA
shell32
ShellExecuteExW
ole32
CoTaskMemFree
Sections
Size: - Virtual size: 162KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.imports Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.|Tracer Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 3.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.|Tracer Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 1024B - Virtual size: 880B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 5.7MB - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ