Behavioral task
behavioral1
Sample
5da1a2629857c597b6cc0233c79273455c3b3f86661a0e6a43cdf8411b6304d9.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5da1a2629857c597b6cc0233c79273455c3b3f86661a0e6a43cdf8411b6304d9.exe
Resource
win10v2004-20231215-en
General
-
Target
5da1a2629857c597b6cc0233c79273455c3b3f86661a0e6a43cdf8411b6304d9
-
Size
3.7MB
-
MD5
6d974d777b478607d5e081ad5e79ef66
-
SHA1
faca051154b841e0ba6f4b099c371b312104cb69
-
SHA256
5da1a2629857c597b6cc0233c79273455c3b3f86661a0e6a43cdf8411b6304d9
-
SHA512
20da9f60df3dbdf19535e72e70da1132a60b52605a3c05d3ad8e9172af2a379d159bdb74b57e48841f0ebd626b0e25bd132cdf99c2e3c3951c50f3e10244c68f
-
SSDEEP
98304:9TObiWS5XGcbY1ce/EHrLZ1zay4al9wU7BY:hUSfs3sHrN1Oy4al9wUVY
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5da1a2629857c597b6cc0233c79273455c3b3f86661a0e6a43cdf8411b6304d9
Files
-
5da1a2629857c597b6cc0233c79273455c3b3f86661a0e6a43cdf8411b6304d9.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 695KB - Virtual size: 840KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 625B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 14B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.imports Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 5.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 3.0MB - Virtual size: 3.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ