Behavioral task
behavioral1
Sample
ReversedByAJ.exe
Resource
win10v2004-20240226-en
General
-
Target
ReversedByAJ.exe
-
Size
56.2MB
-
MD5
c0f331f6bf31a7e63bd7c106ba1e90c8
-
SHA1
88a5ea56e59d79bceb8197e54c82aac875e99253
-
SHA256
b69a7bd159e4b62c48a74177087f1565038e948dfa348f5bef781e04492f142f
-
SHA512
46d664193a261e533f9d9b0a540011a8e4a87df4e724e903da0034fc18191c41825510ca988887080799800171c0a53d2933e46fd3d1917c346040adcd2238e7
-
SSDEEP
786432:liQX0HeDPBZH++O6FPYvndsLOvIX4VqISdcM/Il:liQX0+DBZHvpYvndmObqI
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ReversedByAJ.exe
Files
-
ReversedByAJ.exe.exe windows:6 windows x64 arch:x64
f9e5f3ac7beb27e569880e042d534668
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
advapi32
CryptGetHashParam
GetLengthSid
InitializeAcl
IsValidSid
SetSecurityInfo
CopySid
CryptAcquireContextA
CryptReleaseContext
CryptGenRandom
GetTokenInformation
RegOpenKeyExA
OpenProcessToken
RegSetValueExA
RegCreateKeyExA
RegQueryValueExA
ConvertSidToStringSidA
RegCloseKey
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptEncrypt
AddAccessAllowedAce
crypt32
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CryptStringToBinaryA
PFXImportCertStore
CertAddCertificateContextToStore
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptDecodeObjectEx
CryptQueryObject
CertGetNameStringA
CertFindExtension
d3dcompiler_43
D3DCompile
imm32
ImmSetCandidateWindow
ImmSetCompositionWindow
ImmGetContext
ImmReleaseContext
kernel32
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
SetFileInformationByHandle
GetStartupInfoW
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
GetTempPathW
AreFileApisANSI
GetFileAttributesW
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetFileInformationByHandleEx
SetThreadContext
CreateProcessA
GetProcessHeap
GetCurrentProcessId
ReadProcessMemory
LocalFree
VirtualAllocEx
GetThreadContext
SetFileAttributesA
HeapAlloc
CloseHandle
Process32Next
GetFileAttributesA
GetLastError
Sleep
CreateToolhelp32Snapshot
OpenProcess
ResumeThread
CreatePipe
TerminateProcess
VirtualAlloc
FindNextFileW
FindFirstFileExW
FindClose
GetLocaleInfoEx
WaitForMultipleObjects
PeekNamedPipe
GetFileType
GetStdHandle
GetEnvironmentVariableA
WaitForSingleObjectEx
MoveFileExA
GetTickCount
VerifyVersionInfoA
GetSystemDirectoryA
SleepEx
LeaveCriticalSection
EnterCriticalSection
FormatMessageA
SetLastError
QueryFullProcessImageNameW
GetModuleHandleW
CreateFileMappingW
VirtualProtect
CreateThread
DeleteCriticalSection
InitializeCriticalSectionEx
GetCurrentProcess
HeapFree
WriteProcessMemory
Process32First
GetModuleFileNameA
ReadFile
QueryPerformanceCounter
FreeLibrary
VerSetConditionMask
GetProcAddress
QueryPerformanceFrequency
LoadLibraryA
GetModuleHandleA
GlobalUnlock
WideCharToMultiByte
GlobalLock
GlobalFree
HeapSize
HeapDestroy
CreateFileA
GetFileSizeEx
HeapReAlloc
MapViewOfFile
UnmapViewOfFile
GlobalAlloc
MultiByteToWideChar
CreateFileMappingA
CreateFileW
msvcp140
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?setf@ios_base@std@@QEAAHHH@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV?$basic_ios@DU?$char_traits@D@std@@@1@AEAV21@@Z@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ
?do_encoding@?$codecvt@_SDU_Mbstatet@@@std@@MEBAHXZ
??4?$_Iosb@H@std@@QEAAAEAV01@$$QEAV01@@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?do_encoding@?$codecvt@_SDU_Mbstatet@@@std@@MEBAHXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
_Query_perf_frequency
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Throw_Cpp_error@std@@YAXH@Z
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Winerror_map@std@@YAHH@Z
?_Xbad_function_call@std@@YAXXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Syserror_map@std@@YAPEBDH@Z
_Cnd_do_broadcast_at_thread_exit
_Thrd_sleep
_Query_perf_counter
_Thrd_detach
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
_Xtime_get_ticks
?good@ios_base@std@@QEBA_NXZ
normaliz
IdnToAscii
psapi
GetModuleInformation
rpcrt4
UuidToStringA
RpcStringFreeA
UuidCreate
shell32
ShellExecuteA
user32
GetWindowRect
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
GetCursorPos
SetCursorPos
ReleaseCapture
IsWindowUnicode
GetClientRect
SetCursor
SetCapture
GetForegroundWindow
TrackMouseEvent
ClientToScreen
GetCapture
ScreenToClient
LoadCursorA
GetKeyState
UpdateWindow
PostQuitMessage
PeekMessageA
LoadIconA
TranslateMessage
SetLayeredWindowAttributes
DefWindowProcA
MoveWindow
MessageBoxA
GetWindowLongA
SetWindowLongA
ShowWindow
RegisterClassExW
UnregisterClassW
GetSystemMetrics
CreateWindowExW
DispatchMessageA
SetClipboardData
DestroyWindow
userenv
UnloadUserProfile
vcruntime140
__std_exception_destroy
__std_exception_copy
__std_terminate
strstr
strrchr
__intrinsic_setjmp
__C_specific_handler
__current_exception_context
__current_exception
strchr
_CxxThrowException
memcmp
memchr
memset
memcpy
memcpy
longjmp
vcruntime140_1
__CxxFrameHandler4
wldap32
ldap_value_freeW
ldap_get_dnA
ldap_first_attributeA
ldap_initA
ldap_next_attributeA
ldap_get_values_lenA
ldap_next_entry
ldap_first_entry
ldap_sslinitA
ldap_unbind_s
ldap_set_optionA
ldap_simple_bind_sA
ldap_bind_sA
ldap_search_sA
ldap_msgfree
ldap_err2stringA
ldap_memfreeA
ber_free
ws2_32
ioctlsocket
closesocket
accept
htonl
listen
recv
send
WSAGetLastError
bind
connect
WSAStartup
getpeername
getsockname
__WSAFDIsSet
getsockopt
htons
select
htons
setsockopt
socket
getaddrinfo
htonl
WSASetLastError
WSAIoctl
gethostname
sendto
recvfrom
FreeAddrInfoW
WSACleanup
ucrtbase
_strtoi64
strtol
strtoul
atoi
_strtoui64
strtod
_lock_file
_unlock_file
_fstat64
_access
_unlink
remove
_stat64
_set_new_mode
realloc
malloc
_callnewh
calloc
free
localeconv
_configthreadlocale
___lc_codepage_func
ceilf
sqrtf
acosf
_dsign
_dclass
cos
cosf
fmodf
roundf
sin
sinf
__setusermatherr
_mbsrchr
_mbscmp
_resetstkoflw
system
terminate
_errno
exit
_invalid_parameter_noinfo_noreturn
_wassert
strerror
__sys_nerr
_register_thread_local_exe_atexit_callback
_c_exit
_invalid_parameter_noinfo
_Exit
_initterm_e
_initterm
_get_narrow_winmain_command_line
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_getpid
_beginthreadex
__acrt_iob_func
_lseeki64
__stdio_common_vsprintf
fread
__stdio_common_vsscanf
feof
fputs
fopen
_pclose
_set_fmode
__p__commode
__stdio_common_vfprintf
_popen
_read
fgets
_write
_get_stream_buffer_pointers
_fseeki64
fsetpos
ungetc
_close
fputc
setvbuf
fgetpos
_open
fseek
ftell
fgetc
fclose
_wfopen
fwrite
fflush
_mbsdup
isupper
strncmp
strcmp
strncpy
tolower
strpbrk
strspn
strcspn
_localtime64
_time64
strftime
_localtime64_s
_gmtime64
qsort
d3d11
D3D11CreateDeviceAndSwapChain
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
dwmapi
DwmExtendFrameIntoClientArea
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 333KB - Virtual size: 344KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 7.6MB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 55KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.imports Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: 28.5MB - Virtual size: 28.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 18.4MB - Virtual size: 18.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
.SCY Size: 14KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE