Behavioral task
behavioral1
Sample
RENAME_ME.exe
Resource
win7-20231215-en
General
-
Target
1a50c19202c6748916a2cd5e0596636e
-
Size
1.4MB
-
MD5
1a50c19202c6748916a2cd5e0596636e
-
SHA1
0d92584d0e571485f183ea535710bcfbd08cc4cc
-
SHA256
a25c7a5931eff2b7e5fca8e037c2129d718889b5eece030cd1f0c4f8afb66585
-
SHA512
82c12336db1cb79d3bc295014f3b5ac016556f17b65442583d1204744c82e74f6eec662ab39aad5374f2d69e8dc612e5b1d80ea22eee055a63265a4bf75253d7
-
SSDEEP
24576:/bZlrWKfgiDikpBi39g/m8YcjNLTPO3JM1eF8kS/zor+TMPQTluvXwvbPnMbWccR:tbf/DikSiu8HdzOqeFDejMYhuIvbPMb8
Malware Config
Signatures
-
resource yara_rule static1/unpack001/RENAME_ME.exe themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/RENAME_ME.exe
Files
-
1a50c19202c6748916a2cd5e0596636e.rar
-
Config.cfg
-
READ_ME.txt
-
RENAME_ME.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 764KB - Virtual size: 796KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Themida Size: 652KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE