Behavioral task
behavioral1
Sample
780df454604e9ef9d24373bc1b29ab4cd80ae44e62859bcdf5e5bea31a2cd68e.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
780df454604e9ef9d24373bc1b29ab4cd80ae44e62859bcdf5e5bea31a2cd68e.exe
Resource
win10v2004-20231215-en
General
-
Target
780df454604e9ef9d24373bc1b29ab4cd80ae44e62859bcdf5e5bea31a2cd68e
-
Size
2.3MB
-
MD5
1088d792fc368027304b580a73e90781
-
SHA1
796747255465ba7ffe2718e782d4111e30566aa5
-
SHA256
780df454604e9ef9d24373bc1b29ab4cd80ae44e62859bcdf5e5bea31a2cd68e
-
SHA512
18075a78309fecc785b25ffd0f656001c4e7a12d32f2f73896e8af682fffb2fe5b83d4be0628d488ad0025807cabf43d7f3063428c8ffb835635b860d0e8b89c
-
SSDEEP
49152:XtpIz4TLoGDoBJk/i3FcVLNXJtv9jZBeTSkAYTeAkzh5JZpC9O8dsoUQ+rQi9m:nIz43PakF1Nj9jjSRTY/uO8dhU47
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 780df454604e9ef9d24373bc1b29ab4cd80ae44e62859bcdf5e5bea31a2cd68e
Files
-
780df454604e9ef9d24373bc1b29ab4cd80ae44e62859bcdf5e5bea31a2cd68e.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 13KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 747B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 40KB - Virtual size: 313KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 585B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.imports Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ