Behavioral task
behavioral1
Sample
049e3c67dde477eed94a13676fed24a9bfde4fe0bc8c01c97737904277dccd4f.exe
Resource
win7-20240221-en
General
-
Target
049e3c67dde477eed94a13676fed24a9bfde4fe0bc8c01c97737904277dccd4f
-
Size
1.6MB
-
MD5
2b31ea9e5edc95fa5c428886b9bfffc3
-
SHA1
6f7710180be71028196d3160a2f2c9a8c4242c52
-
SHA256
049e3c67dde477eed94a13676fed24a9bfde4fe0bc8c01c97737904277dccd4f
-
SHA512
f28fd53bd32f6dd37fce0f38d3eccb26bece32b7464ea1455264f5b72ab7da8a1d0a18e56377064e5745c9ed085a5888fbd7f0addb536e3a0bbbb80fd4eb801e
-
SSDEEP
24576:Lahbe6L9e3lj+W5nymOX1FTFhIDKucpT20FoM7iGhMAQhNZdZeQWefhhJbqExK4j:Lsen3smINIDKzT2HMvLQhNZdMEOEwo
Malware Config
Signatures
-
resource yara_rule sample themida -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule sample autoit_exe -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 049e3c67dde477eed94a13676fed24a9bfde4fe0bc8c01c97737904277dccd4f
Files
-
049e3c67dde477eed94a13676fed24a9bfde4fe0bc8c01c97737904277dccd4f.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 680KB - Virtual size: 680KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Themida Size: 655KB - Virtual size: 660KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE