Behavioral task
behavioral1
Sample
5bf224d571ac2670c97a3af9a87400805575b728e8c0a32e4f12f2f88d0ff2a6.exe
Resource
win7-20240221-en
General
-
Target
d21a17b082c180ab291d60acd6472c08.bin
-
Size
10.2MB
-
MD5
7b03b644550d1dace3a4f5ff90db128c
-
SHA1
e4924bb0e591374655fb3f10ac49fe1d2b735f62
-
SHA256
a0fed10511c4dc1c252c8cefaf123842871e0610d469f3155f60dfa2892e31c7
-
SHA512
a24bd1ff3b74b60346febaae6978abc6fa287663e9fa88ff161fa5456c1fd316bebfe3c45c5201c96e11ce3b88d167a8f9884141ca8b0eb653cb963d5723f9d2
-
SSDEEP
196608:i2+Cu33rnEnbovkdkp+drm9H0VF+96wmcCaeAk18tF7QOlhhBkRH0hKIWwHpd:Lp4rMboMkMS+4Ywz096BXEsKIfpd
Malware Config
Signatures
-
resource yara_rule static1/unpack001/5bf224d571ac2670c97a3af9a87400805575b728e8c0a32e4f12f2f88d0ff2a6.exe themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/5bf224d571ac2670c97a3af9a87400805575b728e8c0a32e4f12f2f88d0ff2a6.exe
Files
-
d21a17b082c180ab291d60acd6472c08.bin.zip
Password: infected
-
5bf224d571ac2670c97a3af9a87400805575b728e8c0a32e4f12f2f88d0ff2a6.exe.exe windows:4 windows x64 arch:x64
Password: infected
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Sections
Size: 22KB - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 6.7MB - Virtual size: 9.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 1KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 7KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 96B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 120B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 5.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 3.5MB - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 16B - Virtual size: 4KB
IMAGE_SCN_MEM_READ