Behavioral task
behavioral1
Sample
e54ca0dba46a135e411372c3ca85ada17c2d795617f2c53ffbb4eb6771e28c91.exe
Resource
win7-20231215-en
General
-
Target
e54ca0dba46a135e411372c3ca85ada17c2d795617f2c53ffbb4eb6771e28c91
-
Size
8.7MB
-
MD5
1cd8f01a566c25a80c971b5ff4e7a80a
-
SHA1
a65e209c5b343413a570e5e15a7e7e7bb3b96b5c
-
SHA256
e54ca0dba46a135e411372c3ca85ada17c2d795617f2c53ffbb4eb6771e28c91
-
SHA512
e752884f0d1fbd8ca52516e04af63f16d42640d5e32d94eaa3a202baf01e3f8a70003060f3e79cfcfdd330c818c03440c019ca5c3f1b352047c17d5a7e193ef5
-
SSDEEP
196608:3FMCJJSldZFPknPJgiRk2P+lHbcwi1CzIoaRDnda7dTK+4v0:1MCJJSrrY5SqwOCqkde+4M
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e54ca0dba46a135e411372c3ca85ada17c2d795617f2c53ffbb4eb6771e28c91
Files
-
e54ca0dba46a135e411372c3ca85ada17c2d795617f2c53ffbb4eb6771e28c91.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 784KB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 94KB - Virtual size: 306KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 13KB - Virtual size: 86KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 20B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.3MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 213KB - Virtual size: 213KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 7.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 4.7MB - Virtual size: 4.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ