Resubmissions
25/04/2024, 21:14
240425-z3d7dafa69 9Behavioral task
behavioral1
Sample
dgDjJOlBVw.exe
Resource
win7-20240221-en
General
-
Target
loader.zip
-
Size
4.0MB
-
MD5
2ec5fb0a59b69773c91a6e0582deb4e4
-
SHA1
5fb166defd730ca89aa6298f1bd97395f010a3d5
-
SHA256
a1598a7a0a5c1d0b8f1ae301c9a3c53f8f77ac4c03367f4e17323fe4987a6151
-
SHA512
39a7f40dbe00be4f8420661f1258d7d293641d2d020b0e703e7fffb98fa2bd90b1f1ffb934d40540820e89be37b133242ded5168aeb293c0043a5812047dfc0d
-
SSDEEP
98304:OyuYdrs3TfDoraUTHIQeNWPrTPt+lL0SB6NB:Fldw3rMFTHIJA3Pt+lMNB
Malware Config
Signatures
-
resource yara_rule static1/unpack001/dgDjJOlBVw.exe themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/dgDjJOlBVw.exe
Files
-
loader.zip.zip
-
dgDjJOlBVw.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 412KB - Virtual size: 861KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 79KB - Virtual size: 210KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 83KB - Virtual size: 203KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 21KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 2KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 5.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 3.4MB - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 16B - Virtual size: 4KB
IMAGE_SCN_MEM_READ