Behavioral task
behavioral1
Sample
1596-58-0x0000000000BC0000-0x000000000199A000-memory.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
1596-58-0x0000000000BC0000-0x000000000199A000-memory.exe
Resource
win10v2004-20240226-en
General
-
Target
1596-58-0x0000000000BC0000-0x000000000199A000-memory.dmp
-
Size
13.9MB
-
MD5
227262e17e90a5823a33425f65eba3e3
-
SHA1
02bf1aeee9dafc8a08410207bf826bb326b5122c
-
SHA256
c73e121e55c5587d38c687df4a41e647da1540ae348ede86557f0b9309d5bb23
-
SHA512
fea654a32480449ecd0cd218bac2caeee87e73d3dded7e9273f3ed8c881db82106d3e9b01bf70608625d0c0992442a6d22c3362656b521ff9bb1d6aa4d586ac2
-
SSDEEP
196608:KMO2bLwFhe8EBhrdCcFTuHvp6jD2+lSkcT81TQCDry2GBrq8B8rc+Q:rOEyhOdLTAwjar8TzDry2G5GpQ
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1596-58-0x0000000000BC0000-0x000000000199A000-memory.dmp
Files
-
1596-58-0x0000000000BC0000-0x000000000199A000-memory.dmp.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
Size: 128KB - Virtual size: 128KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 95KB - Virtual size: 95KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ