Behavioral task
behavioral1
Sample
c3fb9cd5c829557e1b923f239c38e85d.exe
Resource
win7-20240220-en
General
-
Target
c3fb9cd5c829557e1b923f239c38e85d
-
Size
832KB
-
MD5
c3fb9cd5c829557e1b923f239c38e85d
-
SHA1
b6a246031c96d0b023cf683d3983a1dee2584a34
-
SHA256
2975df3af60e9a6cf31deaa07791334db357c8c3fd6cdbdf42390e68e0019e56
-
SHA512
06cae12b30641846be26e625f2a491df840724fb4c02e37d897a1051587f464f054f8f69a023cdbace380f0b114f21c03d2f747470856ed07392fe2012712c2a
-
SSDEEP
12288:j3ZBBMcYE14XLoR598T65NrN5jjqdf7Ps8qEU1TARfvh6Jr3Hp0T3Yw/9Km:j3ZBaHg4XMRasNJB+d75UJ4Ru0rHM
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c3fb9cd5c829557e1b923f239c38e85d
Files
-
c3fb9cd5c829557e1b923f239c38e85d.exe .ps1 windows:4 windows x86 arch:x86 polyglot
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 16KB - Virtual size: 300KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Themida Size: 808KB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE