Behavioral task
behavioral1
Sample
43432edd6b9cd7ed7e298fb4e873b649.exe
Resource
win7-20231215-en
General
-
Target
43432edd6b9cd7ed7e298fb4e873b649
-
Size
2.6MB
-
MD5
43432edd6b9cd7ed7e298fb4e873b649
-
SHA1
901b591a659709fb535d919ba0caa8675a2bee74
-
SHA256
dbd9687241cf26d12879c85b69ab3e1fb7255b0aecd940873dfdcb8f51176aa8
-
SHA512
f90829bea43970603dc0ca581fc31c767607bde0b8fbec4caeca013f89fa4c30347ce890904658547cdb5d99085021d673e10d82f6869b7523ebbfb0f44bdc78
-
SSDEEP
49152:pUONdBlcCDnwfTxNyOAznH+z+xSZOnP6s5HKYLHe6MUu8taAiLwq9iCp7ZdtaAWA:24dMCOTxNyOqbK+PN5H/qU57Gwq9Dp77
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 43432edd6b9cd7ed7e298fb4e873b649
Files
-
43432edd6b9cd7ed7e298fb4e873b649.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 45KB - Virtual size: 112KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 397B - Virtual size: 860B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 15B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.imports Size: 1024B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 4.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.taggant Size: 8KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ