Behavioral task
behavioral1
Sample
1c489753ebbe4fbdfd0216c081e2d69a75b900907d3063ffd8c78d07b0b09d1e.exe
Resource
win7-20240221-en
General
-
Target
1c489753ebbe4fbdfd0216c081e2d69a75b900907d3063ffd8c78d07b0b09d1e
-
Size
12.5MB
-
MD5
915af65b2b0faec9eae27a635497f013
-
SHA1
0df6edb1d22d86a41972d77ad4f249fcd991ed7f
-
SHA256
1c489753ebbe4fbdfd0216c081e2d69a75b900907d3063ffd8c78d07b0b09d1e
-
SHA512
2a2aa25599e6be04363162730264e1bc54b4e9489eb0e8213d7b5385caaacb80780786e974f113a2d32711e99289820309831b301c7819cd01095fb33078d397
-
SSDEEP
196608:jWcAZWkm7xDLygT5SD0lNpj26ys1qb7FlJauyC6K8G8pr6I/yJLth2WuS:jWcAgZDL5T5SDIqswcub6RdyJLt9
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1c489753ebbe4fbdfd0216c081e2d69a75b900907d3063ffd8c78d07b0b09d1e
Files
-
1c489753ebbe4fbdfd0216c081e2d69a75b900907d3063ffd8c78d07b0b09d1e.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 1020KB - Virtual size: 1016KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 112KB - Virtual size: 532KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.themida Size: 6.6MB - Virtual size: 6.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
rsrr Size: 2KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE