Behavioral task
behavioral1
Sample
d58ed8d3201afdce5e3f857ae4c63351ad182638f816dca1d0cb682cc1fa440d.exe
Resource
win7-20240221-en
General
-
Target
d58ed8d3201afdce5e3f857ae4c63351ad182638f816dca1d0cb682cc1fa440d
-
Size
5.4MB
-
MD5
81ed9fc245b00937728b1bd092060334
-
SHA1
5f318e5295f45a1b2f86a7d01e122f4588312868
-
SHA256
d58ed8d3201afdce5e3f857ae4c63351ad182638f816dca1d0cb682cc1fa440d
-
SHA512
8112781038c7d7f64abc1d487014faa9529e309c167432e015ffd47492bbbcc98d77210d893a20df4fe5539c4a4d1fd76a5176fd9cd7fc98ea85f479a7072b16
-
SSDEEP
98304:dMe9GwKcFpCMHOFRPLYW3Xehtw6drROZ8b+14gVbbkgsc5:UwfdHO7YWHcrROZ8bngl4gb
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d58ed8d3201afdce5e3f857ae4c63351ad182638f816dca1d0cb682cc1fa440d
Files
-
d58ed8d3201afdce5e3f857ae4c63351ad182638f816dca1d0cb682cc1fa440d.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 981KB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 1.0MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 84KB - Virtual size: 779KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 27KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 180B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 12KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 4B
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.themida Size: - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 3.2MB - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ