Behavioral task
behavioral1
Sample
6393577eccbb54f677ff7dd65c984807.exe
Resource
win7-20231129-en
General
-
Target
6393577eccbb54f677ff7dd65c984807
-
Size
3.0MB
-
MD5
6393577eccbb54f677ff7dd65c984807
-
SHA1
5020ec827081c486c32af374473d96ce5f4f30de
-
SHA256
fb7f48daa45730568caa82cfa74c3c3a16130d2428ccef71eb266daa4146efde
-
SHA512
81e6e3b90072454e6497e1622b6d43371ca3c43cb5a073364b9f9db1c85866b1b9614f56c0b5c970b456cba7ffd0a7e8ce490649ec189c52d234b5e7e68a6d28
-
SSDEEP
49152:hU6pv81VrL49dOdL4hE+oQ2OkCe2OtIcm+H2w6JFqtEI8X3nUywRve:C6pJ9dO6hhofOkCCycm+WRJFnlNI
Malware Config
Signatures
-
Processes:
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 6393577eccbb54f677ff7dd65c984807
Files
-
6393577eccbb54f677ff7dd65c984807.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 407KB - Virtual size: 784KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 52KB - Virtual size: 117KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 2KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 18KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ