Behavioral task
behavioral1
Sample
o_0/o_0/cheeto.exe
Resource
win11-20240221-en
General
-
Target
o_0.rar
-
Size
3.9MB
-
MD5
4144eca4d46ab0bd4d0aba4e8a66d50f
-
SHA1
d689366fcb2c3714b88549bc88148a00df8ea2b2
-
SHA256
87b149457fc90f296ee709fe39c15672cd0966903f92cb4a02b504cd6de48080
-
SHA512
f639d07805e7a84853bae5c435066d7a1742d152df3fae6f2cd8f4c3ae9f77f6f6ff5c622ed1410d2a5c8319ac61f07c68db58bc032d48e6c64a4049e010901b
-
SSDEEP
98304:FzE4P5bNXMxY2c8Nutfisdlzm5wSl3n9dATs5F:i4P5B6nceudisddm2SFMOF
Malware Config
Signatures
-
resource yara_rule static1/unpack001/o_0/o_0/cheeto.exe themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/o_0/o_0/cheeto.exe
Files
-
o_0.rar.rar
-
o_0/o_0/READ ME!.txt
-
o_0/o_0/cheeto.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 453KB - Virtual size: 951KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 101KB - Virtual size: 238KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 94KB - Virtual size: 174KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 20KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 275B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 1KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.imports Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 3.3MB - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 16B - Virtual size: 4KB
IMAGE_SCN_MEM_READ