Behavioral task
behavioral1
Sample
Aremi v3_protected.exe
Resource
win10v2004-20240226-en
General
-
Target
Aremi v3_protected.exe
-
Size
5.8MB
-
MD5
30818cad2e5983aa365339ac70ed29ec
-
SHA1
76c48c83c2d891f9a307b3a087b7ca29b844c06e
-
SHA256
8a956dd81ce0c500f2a8ca58febde609733686dae94c91263ad7bc560e4ba9a4
-
SHA512
a33f0a91f7fb37996bad0992256c23d83b78fb7335c28c257fb4b97648eb69a7399f47486b61c16a1890e5139891ad70ffbd677ec4edadb62aaac702384e12a3
-
SSDEEP
98304:HqvT9n5S50x9ojeVlqHOEULzgLOLkD9KCAbN3pwim/OIgWMDgdMCMDgx:K7TSypVlASLzsJ9KdNZ6gWMDgdMCMDgx
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Aremi v3_protected.exe
Files
-
Aremi v3_protected.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 36KB - Virtual size: 100KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 7.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 4.2MB - Virtual size: 4.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ