Start
Behavioral task
behavioral1
Sample
ed54ed75c515a61c7ddbb9d50c824f901fd4fae098fb0a21569426314fb922d9.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ed54ed75c515a61c7ddbb9d50c824f901fd4fae098fb0a21569426314fb922d9.exe
Resource
win10v2004-20240412-en
General
-
Target
ed54ed75c515a61c7ddbb9d50c824f901fd4fae098fb0a21569426314fb922d9
-
Size
4.8MB
-
MD5
7e89d00ba5a0934580add54c1b290f4c
-
SHA1
1abf9eae56a5edcc5ad1b8fdd0642f976c911fa1
-
SHA256
ed54ed75c515a61c7ddbb9d50c824f901fd4fae098fb0a21569426314fb922d9
-
SHA512
62e9bc1dd0f7691cd0a5e9fe925b0c13a592e66cae4522c3a9604171b6f2eb8eff798055584dd9b549f4f4d7c0500fd145ac1320adcb701120708221057409af
-
SSDEEP
98304:bDaih55bwCbRdjgHJsrEN7gJu3fRRujdz13l+iLG9tAjZbgPi7fF:lvJ7gpsrW7hf/q3E4hpfF
Malware Config
Signatures
-
Detects executables packed with Themida 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_Themida -
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ed54ed75c515a61c7ddbb9d50c824f901fd4fae098fb0a21569426314fb922d9
Files
-
ed54ed75c515a61c7ddbb9d50c824f901fd4fae098fb0a21569426314fb922d9.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: - Virtual size: 161KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmpü× Size: - Virtual size: 946KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.themida Size: - Virtual size: 3.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmpü× Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmpü× Size: 1024B - Virtual size: 944B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmpü× Size: 5.8MB - Virtual size: 5.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 578B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ