Behavioral task
behavioral1
Sample
run.zip
Resource
win11-20240221-en
Behavioral task
behavioral2
Sample
run/0000245C-7BAC-B16A-3EED-0000A8AD.tmp
Resource
win11-20240221-en
Behavioral task
behavioral3
Sample
run/fdsfsdfdfdfsd.exe
Resource
win11-20240221-en
General
-
Target
run.zip
-
Size
3.9MB
-
MD5
f52154a9586607f75862c40fa4b905ea
-
SHA1
bde70ecfc7e7a7ed80142fe73cc0f90c0b9e8173
-
SHA256
f91eae581b2bfc6f8c54bec84b9f29c0639475ab72aabad25ed7be02e941a54c
-
SHA512
e07b32e73ddacfbe5298f4b9ac5b132f79bd08f973a2eb013d69a5e9d7920ebbe4ace983d9e3de925a0147c09d4e20455367eefb3f7c37f5d70e006acb33cf62
-
SSDEEP
98304:g7OcMToZR/bJAPGskLJdbzqDYONuzcM+Pv0JxwjvIP:gqCMGNdd8ScMY0IjgP
Malware Config
Signatures
-
resource yara_rule static1/unpack001/run/fdsfsdfdfdfsd.exe themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/run/fdsfsdfdfdfsd.exe
Files
-
run.zip.zip
-
run/0000245C-7BAC-B16A-3EED-0000A8AD.tmp
-
run/fdsfsdfdfdfsd.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 268KB - Virtual size: 558KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 38KB - Virtual size: 85KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 1024B - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 9KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 1024B - Virtual size: 704B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 6.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 3.6MB - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 16B - Virtual size: 4KB
IMAGE_SCN_MEM_READ