Behavioral task
behavioral1
Sample
00da1634b48b890cba5999ddcfe59d68.exe
Resource
win7-20231129-en
General
-
Target
00da1634b48b890cba5999ddcfe59d68
-
Size
2.8MB
-
MD5
00da1634b48b890cba5999ddcfe59d68
-
SHA1
734833fcce060e5c0aacc6790da8c1d856373b25
-
SHA256
43fc1d8c05ea20fbdca6664567b2090fa766d8d6513913b516e627e8f6bb0436
-
SHA512
4baec5076b1fb14870dfb174ddf64802ec52e419ccc6c2ac6c3ec7f5afe2b873ddf233c5d6c765afe419aeb6aece8b3020a5d01a648b4d1df78d56ba5cac60cb
-
SSDEEP
49152:AfjveQerQqZXlfyvb2QKgIpIgM4Ya74QTDDYa6ZTLx7nHkaFfqcqciq7mzwM:AfjeQIXFaIp8MXDUx5HkanRiNT
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 00da1634b48b890cba5999ddcfe59d68
Files
-
00da1634b48b890cba5999ddcfe59d68.exe windows:5 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 341KB - Virtual size: 636KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 30KB - Virtual size: 142KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 4KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 97KB - Virtual size: 656KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.imports Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 170KB - Virtual size: 170KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ