Behavioral task
behavioral1
Sample
1d8f32a4bcd066413acbb8c4bf6037c9.exe
Resource
win7-20231215-en
General
-
Target
1d8f32a4bcd066413acbb8c4bf6037c9
-
Size
4.7MB
-
MD5
1d8f32a4bcd066413acbb8c4bf6037c9
-
SHA1
039c71f5a96b4c079671c46515d8af15720f81ea
-
SHA256
5d682001504dc58701765ca9721e4b4b9eb5b5e73469731fe787d15217cd7435
-
SHA512
b746597e9b33c02070b174dcf2303795aa74b924ba8d435132638ae3c2df30bf7db7549a66849221379a279b14d6349afac10b75aa23bc0293f4dc212d168e11
-
SSDEEP
98304:JVzGNV9HkAK+sGxBlPKHj6ePKVpP+JRILRe/FaEZeSoPdVaKU+Ft:PzGNVyAK+txBliAVpPYGRe/FPD8dVaKU
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1d8f32a4bcd066413acbb8c4bf6037c9
Files
-
1d8f32a4bcd066413acbb8c4bf6037c9.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 97KB - Virtual size: 192KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
┞ Quiz Size: 964KB - Virtual size: 964KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.themida Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 964KB - Virtual size: 964KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ