Behavioral task
behavioral1
Sample
d367e1b2a244ba3ab2be4a692275d29c.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d367e1b2a244ba3ab2be4a692275d29c.exe
Resource
win10v2004-20240226-en
General
-
Target
d367e1b2a244ba3ab2be4a692275d29c
-
Size
2.6MB
-
MD5
d367e1b2a244ba3ab2be4a692275d29c
-
SHA1
2488c7884e70a64abb08ea2b1c58737b0a1b00f6
-
SHA256
cbda96fe7e6d9c9876ae28264da1b197cf9b5825f598ee3cd36aafdd04d85728
-
SHA512
3e40ea3d268883f9009600a80a03af54d317d2d2179efa4989fa4c788904160417c582377d9ec5903d064f32211664e8e63866cf9469c33efa08ced32bf3a488
-
SSDEEP
49152:tU/5M1X4Wl/YvzYCQR9RQs+C40yZpJaD99G0:tKq4oEa9RQs+Cn4/UK0
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d367e1b2a244ba3ab2be4a692275d29c
Files
-
d367e1b2a244ba3ab2be4a692275d29c.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 34KB - Virtual size: 100KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 7B - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ