Behavioral task
behavioral1
Sample
632da61d97169f077e1849dd3a723dff.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
632da61d97169f077e1849dd3a723dff.exe
Resource
win10v2004-20231215-en
General
-
Target
632da61d97169f077e1849dd3a723dff
-
Size
3.2MB
-
MD5
632da61d97169f077e1849dd3a723dff
-
SHA1
7c5caf2ff210ba2fa9a54f64298ee0ecc784a75d
-
SHA256
567e02ad3d51c0b17c2e921903984c0b39de3321c08e19dc6e8ee1d6f5dde01d
-
SHA512
2e4e82c2ffc4e7c97f1eeea0be78388d885d129c832502a7b2d8a2811b4f851d17072bb4f0c6bc1eff416ff6666b40e250984a544cd5bf6e1808023d81b34ce5
-
SSDEEP
49152:TY2s4AJd19+bN3q5IZLGEHXm8a9BfBPONLkhXI/dpNwgLzqCeIp7THfkzAnLKG2g:TY0A7saaoQXmbB5m5YapNaCeIZjkzzW
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 632da61d97169f077e1849dd3a723dff
Files
-
632da61d97169f077e1849dd3a723dff.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 267KB - Virtual size: 672KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 290B - Virtual size: 680B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 15B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.imports Size: 1024B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 5.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 3.0MB - Virtual size: 3.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ