Behavioral task
behavioral1
Sample
2a9f4fe4ed92fab3c74d2aa7c70fdb25.exe
Resource
win7-20231201-en
Behavioral task
behavioral2
Sample
2a9f4fe4ed92fab3c74d2aa7c70fdb25.exe
Resource
win10v2004-20231201-en
General
-
Target
2a9f4fe4ed92fab3c74d2aa7c70fdb25
-
Size
3.1MB
-
MD5
2a9f4fe4ed92fab3c74d2aa7c70fdb25
-
SHA1
4eb18df8a0ca8d17d7ecdf6750b3b192d8089d76
-
SHA256
41cb80c0850dd83c6bf3b40b3181be39b2a9a3ab586a3206a12f442f1c98632a
-
SHA512
a40b70c70a7ce24f77acc7263cf5fdf7a999cec896eff20174508d63d0f232cb49515337b1d18bf303bc4c2e140e299ebba36f846630666f5b9bb9b4611bd7e8
-
SSDEEP
49152:b59ZZaNeLut/MAyG0TJGQsXa3n7MnXjunZ8BS:b59PaNe4/wGG/sPX7S
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2a9f4fe4ed92fab3c74d2aa7c70fdb25
Files
-
2a9f4fe4ed92fab3c74d2aa7c70fdb25.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 91KB - Virtual size: 240KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IPS Full Size: 786KB - Virtual size: 786KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.themida Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IPS Full Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IPS Full Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IPS Full Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IPS Full Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IPS Full Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IPS Full Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 786KB - Virtual size: 786KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ