Behavioral task
behavioral1
Sample
5ab8767db1bf14c77d2721e13fc8670ab42d403914e84e0453027ea67ba85554.exe
Resource
win7-20240221-en
General
-
Target
5ab8767db1bf14c77d2721e13fc8670ab42d403914e84e0453027ea67ba85554
-
Size
4.6MB
-
MD5
4114a25966e1f02ca5a13a4e70ba4a8f
-
SHA1
0b176a3e114dfbc23b375e78cd2ac229983f52ac
-
SHA256
5ab8767db1bf14c77d2721e13fc8670ab42d403914e84e0453027ea67ba85554
-
SHA512
252fcfc7edf289a1c9b0fb6bdaddd8af02320317d59a26d2b4dfc2f516717d52acd27c1c1abed6ad8c96c5165d389d9516320cbb5e0a8beedd4cfce958ab6579
-
SSDEEP
98304:MnLJFnwls7q5gUa6JqznGW3W5AYYzIIN/GaFwi:MLzn8s76gLGTP8N/2i
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5ab8767db1bf14c77d2721e13fc8670ab42d403914e84e0453027ea67ba85554
Files
-
5ab8767db1bf14c77d2721e13fc8670ab42d403914e84e0453027ea67ba85554.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 176KB - Virtual size: 398KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 2KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 84KB - Virtual size: 110KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 38KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Size: 30KB - Virtual size: 376KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.imports Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 363KB - Virtual size: 363KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 3.9MB - Virtual size: 3.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ