Behavioral task
behavioral1
Sample
79a23099b3c18c175a07c82b3128c485.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
79a23099b3c18c175a07c82b3128c485.exe
Resource
win10v2004-20231222-en
General
-
Target
79a23099b3c18c175a07c82b3128c485
-
Size
632KB
-
MD5
79a23099b3c18c175a07c82b3128c485
-
SHA1
c0657aa6e3d5753513b980e0fff434fbb12347a9
-
SHA256
815274a04d3a6bcaea19329bd98801ab634bf22a1bce3859978de42edf2e093d
-
SHA512
d0fbda921d38cebdaa4e4729de370a2ee06969c7b462b21cca617af0c0b1483bc7e74d51cffa656299279b9c69566d43ea4afd94af6adcbc02ee0908ff015b46
-
SSDEEP
12288:PbS0QkI7UcTBs9oEvt1IM48X4GxtDOn8JiIMgoBugCOrDz7WNW:PbSc4zX83L+8JWAgCOrD3WNW
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 79a23099b3c18c175a07c82b3128c485
Files
-
79a23099b3c18c175a07c82b3128c485.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 212KB - Virtual size: 468KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Themida Size: 396KB - Virtual size: 944KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE