Behavioral task
behavioral1
Sample
bec37fa89e6ddf749d2b828b2a58c9cdcfa52a75c93d6d932382f43eef61c911.exe
Resource
win7-20231215-en
General
-
Target
bec37fa89e6ddf749d2b828b2a58c9cdcfa52a75c93d6d932382f43eef61c911
-
Size
4.1MB
-
MD5
359b77b528fa6634b70f7a682848f131
-
SHA1
ddf40463b43ed6687cf1279feaa6adfcdc8450b1
-
SHA256
bec37fa89e6ddf749d2b828b2a58c9cdcfa52a75c93d6d932382f43eef61c911
-
SHA512
707768a2fe48e62c458cd22f2ed9d54b9394af06d186e54f27089e35f63f43c54aaea7aa0f4b21d4f65f28f6d84f8e15f43d3105845fca49dff9ad451209ac50
-
SSDEEP
98304:sGwiRZzqYgwQMk7M3+6SVJqZkvdl/db1iV01k:ZXZzDgEux1l/db1i0
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bec37fa89e6ddf749d2b828b2a58c9cdcfa52a75c93d6d932382f43eef61c911
Files
-
bec37fa89e6ddf749d2b828b2a58c9cdcfa52a75c93d6d932382f43eef61c911.exe windows:5 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 175KB - Virtual size: 387KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 45KB - Virtual size: 107KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 3KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 13KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 86KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 1KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 73KB - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 6.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 3.7MB - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ