Start
Behavioral task
behavioral1
Sample
8a20efb9ccf6607ba097638b549db9312d478d88eec593920001ffdbffd31c61.exe
Resource
win10v2004-20240226-en
General
-
Target
8a20efb9ccf6607ba097638b549db9312d478d88eec593920001ffdbffd31c61
-
Size
3.0MB
-
MD5
8d9f2aab82562d83974d2235ca367e1c
-
SHA1
217aff8e9fcf328e0585d184791f2ba465a48d03
-
SHA256
8a20efb9ccf6607ba097638b549db9312d478d88eec593920001ffdbffd31c61
-
SHA512
eed74857a5b3b431a3a1045a89f790e8298d142498ddf39ba9db02ef7a2fe6f10988ffed335b37140ed9a0542268de1ad808951b80bb106f9fb3059ac40ac91d
-
SSDEEP
49152:fjbENMmSE62kjPGze+MduQmynDqhkz/hsaCy0RvJ1KPNJPfkIKMJygtNXEdm7sO:fHlmLkrGMFD7z930AJPfrjygvUdDO
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8a20efb9ccf6607ba097638b549db9312d478d88eec593920001ffdbffd31c61
Files
-
8a20efb9ccf6607ba097638b549db9312d478d88eec593920001ffdbffd31c61.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 526KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 66KB - Virtual size: 161KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 2KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 22KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.edata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 3.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ