?init@rzctl@@YA_NXZ
?key_state@rzctl@@YAXFF@Z
?mouse_click@rzctl@@YAXH@Z
?mouse_move@rzctl@@YAXHH_N@Z
Behavioral task
behavioral1
Sample
bat.win_external.exe
Resource
win7-20240221-en
Target
bat.win_external.exe
Size
4.2MB
MD5
3a15201746d47d11f659d8848fc71574
SHA1
c759fd19df4a289d2d3b251f822220e2ea9df57c
SHA256
4188d2de2935e9adc6b37dcc1619e9392a3b3d44f019af87a1b5ad151f4df87d
SHA512
7c9479b5260cc88a0f7b9d7f46fbd4f9c7c1f5c882fb270892f3a2c49a9fada0245c234ac9c65d61500560533345c61447bd67f7f44114234dd8ad22e329c00a
SSDEEP
98304:/fsr5evYrZ6ujAIE/2jc+xKijsunRMqEd/oWwBVv:8j6ujtE/GcSK+hn+qw7wB5
Processes:
resource | yara_rule |
---|---|
sample | themida |
Checks for missing Authenticode signature.
Processes:
resource |
---|
bat.win_external.exe |
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
?init@rzctl@@YA_NXZ
?key_state@rzctl@@YAXFF@Z
?mouse_click@rzctl@@YAXH@Z
?mouse_move@rzctl@@YAXHH_N@Z
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_READ