Resubmissions
21/04/2024, 02:52
240421-dc8seahb62 9Behavioral task
behavioral1
Sample
2xltemp_protected.exe
Resource
win7-20231129-en
General
-
Target
2xltemp_protected.exe
-
Size
4.2MB
-
MD5
874dd5a221ba3c468a2aace0ba398f36
-
SHA1
abe084b0c766814b3b0afb6ed92dbeed0cf6c680
-
SHA256
8bb1b4e7a2c3055ee7f7d815f801024759effa212e2bb29ba69313da64650025
-
SHA512
6a2eca3a929d4e2f84cd23bd9b5b9c5c7e3adc65d06e371f0f3c4f3cf7047205984eb1de06f0379956df0871077428cc530ca297ca1c4ac908443203b900d0ee
-
SSDEEP
49152:/toAw6szUtVPxBPX0QmEcez+V//p2k22CkTyobf2SVpLJktQOTbRMU4wxTn+KYcC:5DV04OjdmoCSVpL2+FwxT+KYc7cfMdy
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2xltemp_protected.exe
Files
-
2xltemp_protected.exe.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 770KB - Virtual size: 776KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 3.4MB - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ