Test
Behavioral task
behavioral1
Sample
111f7344fd0eb6520630241b2d27783ff6c007c24e0d3f64f4836c5ca5b83142.dll
Resource
win7-20240221-en
General
-
Target
111f7344fd0eb6520630241b2d27783ff6c007c24e0d3f64f4836c5ca5b83142
-
Size
2.6MB
-
MD5
90e584a5b63876fa31422304462d4a6e
-
SHA1
2bcbad4baf1b6af682f8e07795c615ace7226293
-
SHA256
111f7344fd0eb6520630241b2d27783ff6c007c24e0d3f64f4836c5ca5b83142
-
SHA512
4d20324f1e02db0fab733a01b17e10f41bf5fb654ed95d0ab58450f390a844c2ab0ed3ac194693e81bea02a9d4773cc08af1ee408d324fc2eaf44fd24698a809
-
SSDEEP
49152:osoSVtm9nMyOMyiIdo3jT6biv2joPQk/EkQinzOU9SNS7tgoRs1vL:oP9MVMrdCbivkIQgEkQzQG7D
Malware Config
Signatures
-
Detects executables packed with Themida 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_Themida -
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 111f7344fd0eb6520630241b2d27783ff6c007c24e0d3f64f4836c5ca5b83142
Files
-
111f7344fd0eb6520630241b2d27783ff6c007c24e0d3f64f4836c5ca5b83142.dll windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
Sections
Size: 166KB - Virtual size: 327KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 22KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 7.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 269KB - Virtual size: 268KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 11KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.edata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 135KB - Virtual size: 135KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 16B - Virtual size: 4KB
IMAGE_SCN_MEM_READ