Behavioral task
behavioral1
Sample
2ba940cf9a7a31aa0cfc73f74e3482e4.exe
Resource
win7-20231129-en
General
-
Target
2ba940cf9a7a31aa0cfc73f74e3482e4
-
Size
3.1MB
-
MD5
2ba940cf9a7a31aa0cfc73f74e3482e4
-
SHA1
2874764e864021db2985ff64ef8dd94d1957f3d8
-
SHA256
9d4c0e742192d990d817e17aa3375658cb704ae49b81a0da85fe4b40fcd14465
-
SHA512
443287c03e81ba5e0bcceef5a5381646579645342c618f86742297605a72537da4c07b86a8dfbf57d553b0f54351f44871f8cb4403179f051f8bcd2133ffcbfd
-
SSDEEP
98304:6Syum4Rwim9q8GN0lEulzh5kte61nqkELcQ0p+IQ+SeEIRt:oUR1m9q8GMlzh5kksqDLAp+IZST8
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2ba940cf9a7a31aa0cfc73f74e3482e4
Files
-
2ba940cf9a7a31aa0cfc73f74e3482e4.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 110KB - Virtual size: 272KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.imports Size: 512B - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.themida Size: - Virtual size: 5.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 3.0MB - Virtual size: 3.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.taggant Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ