Behavioral task
behavioral1
Sample
All-Seeing Eye.exe
Resource
win7-20231129-en
General
-
Target
7d692285d1f88ff19c19da64535a1710
-
Size
3.1MB
-
MD5
7d692285d1f88ff19c19da64535a1710
-
SHA1
c3929b350759ac227511264bab6f50e4e306400a
-
SHA256
c57fd6036c32f3f9cd9c65a335472e411d7de5682a6e2f9aba02b0ad9c332c01
-
SHA512
42701531912f93470644377b2e0be9bf5e723df8cfca051a6f2626fa8203c31a60d407a2b0f2bbbcf7f4f16aa9a048613f93b3c90e362263947b5a5ed2eda1a4
-
SSDEEP
49152:OGzF4ugNFvVo9AeC61KRWhg69oCdQDcELcem2fy4T5fXr1T0sJ80sNtTf2m+i1yl:oJYAeJK169oZL2+1TzQNtuwVtNzW
Malware Config
Signatures
-
resource yara_rule static1/unpack001/All-Seeing Eye.exe themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/All-Seeing Eye.exe
Files
-
7d692285d1f88ff19c19da64535a1710.rar
-
All-Seeing Eye.exe.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 85KB - Virtual size: 180KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 475KB - Virtual size: 642KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 911B - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 366B - Virtual size: 752B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 9B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 10KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.imports Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.themida Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 2.6MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 16B - Virtual size: 4KB
IMAGE_SCN_MEM_READ