Behavioral task
behavioral1
Sample
f95c4076a1fdf2ecd1c46b9a4eed1583c727c0b4415a99aea6ddf473e8a38326.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
f95c4076a1fdf2ecd1c46b9a4eed1583c727c0b4415a99aea6ddf473e8a38326.exe
Resource
win10v2004-20231215-en
General
-
Target
f95c4076a1fdf2ecd1c46b9a4eed1583c727c0b4415a99aea6ddf473e8a38326
-
Size
15.4MB
-
MD5
4045dd3dda15e016309c647772020724
-
SHA1
c026d07e9c9e869f12677902b1d81bd113b0bb2d
-
SHA256
f95c4076a1fdf2ecd1c46b9a4eed1583c727c0b4415a99aea6ddf473e8a38326
-
SHA512
8689cc32e98f9b0e8adedbf7b32508eb729feb0a34448f4bb5051cc3e0ce7b17579b3b308f3c1007f2e3ade26db056ad7aaf263d7f3d4b12c1a0f1610e4d7399
-
SSDEEP
393216:rl/WuAbTNu54q1j+Rd3Ymt17r2Zny+K2qy2n1HKwdUnHWC:rtje4+Rd3Y22Zys2nqnHWC
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f95c4076a1fdf2ecd1c46b9a4eed1583c727c0b4415a99aea6ddf473e8a38326
Files
-
f95c4076a1fdf2ecd1c46b9a4eed1583c727c0b4415a99aea6ddf473e8a38326.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 1.1MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 11.4MB - Virtual size: 11.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 23KB - Virtual size: 233KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 187KB - Virtual size: 301KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.imports Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 284KB - Virtual size: 284KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 3.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ