Behavioral task
behavioral1
Sample
671c8b19c657f67944731db798cc243f.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
671c8b19c657f67944731db798cc243f.exe
Resource
win10v2004-20231222-en
General
-
Target
671c8b19c657f67944731db798cc243f
-
Size
2.6MB
-
MD5
671c8b19c657f67944731db798cc243f
-
SHA1
7ba4924e5e99035a6465dace4635a2e96115425f
-
SHA256
9f292ccfd6f94f3d523056254be66848737c63e86529a8a204bd57ce04cbccfd
-
SHA512
9503599b561dbc0efd19ccb79acb095e1064b5d186f22995dd295b661e0d0d9bb61b1527ccd388b5fc0f8a26d440c5e2cb161cc36f57168c782174f45d5ad6d0
-
SSDEEP
49152:tU/5M1X4Wl/YvzYCQR9RQs+C40yZpJaD99G7:tKq4oEa9RQs+Cn4/UK7
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 671c8b19c657f67944731db798cc243f
Files
-
671c8b19c657f67944731db798cc243f.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 34KB - Virtual size: 100KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 7B - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ