Behavioral task
behavioral1
Sample
a5729a5b6f2df35386f9be46396db18c659ddcea1036673f55e0ab5b2a018ede.exe
Resource
win7-20240221-en
General
-
Target
a5729a5b6f2df35386f9be46396db18c659ddcea1036673f55e0ab5b2a018ede
-
Size
15.6MB
-
MD5
0123ad1c30b08c0ea42904c5797e4f38
-
SHA1
b633e5629fa6a1ebb73343392e344c5ad3586d91
-
SHA256
a5729a5b6f2df35386f9be46396db18c659ddcea1036673f55e0ab5b2a018ede
-
SHA512
27dc325d055d6d4d45db30a9df67d2a8844e7db80b3479ff594a7aea1cadee31877191d4bd691966b16a9f14059accc993815c0633718b64aa82f61b8093f6cf
-
SSDEEP
393216:b4DoykvYJG3WQAxxigrqjKM9u7KwQgdwoTYL:sDoykvYJRQExHrqFPitk
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a5729a5b6f2df35386f9be46396db18c659ddcea1036673f55e0ab5b2a018ede
Files
-
a5729a5b6f2df35386f9be46396db18c659ddcea1036673f55e0ab5b2a018ede.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 1.1MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 11.4MB - Virtual size: 11.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 23KB - Virtual size: 233KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 187KB - Virtual size: 301KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.imports Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 284KB - Virtual size: 284KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ