Behavioral task
behavioral1
Sample
d0798b95c4b98214f9d223c2277c985cb44f3ccdac5b0c2a8d4e608655913818.exe
Resource
win7-20231215-en
General
-
Target
d0798b95c4b98214f9d223c2277c985cb44f3ccdac5b0c2a8d4e608655913818
-
Size
4.9MB
-
MD5
0ca2a3a17040d555c3d1430c075c2363
-
SHA1
1eaf00d24e22f9bd1afebadb730773c15805c0e4
-
SHA256
d0798b95c4b98214f9d223c2277c985cb44f3ccdac5b0c2a8d4e608655913818
-
SHA512
c7a24bbcbaccd23155dba994415a191fd76c424958c5d4a1491034d66883bcdff48137e06f32ce68f0a56de7184d9ea864f3bf19acf21f08156ca95283b3ed0d
-
SSDEEP
98304:KkZDzlEFwdKPJ02Nb4MlsG23/7Q59qqxzSqqT0FXPDmpJJl8HylcNFpRtA:n2Fw2JDhoG9qqxeNT0FmJ2Sl8pRm
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d0798b95c4b98214f9d223c2277c985cb44f3ccdac5b0c2a8d4e608655913818
Files
-
d0798b95c4b98214f9d223c2277c985cb44f3ccdac5b0c2a8d4e608655913818.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 99KB - Virtual size: 163KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 18KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 2KB - Virtual size: 215KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 376B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 32KB - Virtual size: 175KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 9KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.edata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 103KB - Virtual size: 103KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 4.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ