Behavioral task
behavioral1
Sample
3911d35f21aa834cc70c2cf0a57e5453e00a49f0cdc686fc4e9d93ad76eafe36.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
3911d35f21aa834cc70c2cf0a57e5453e00a49f0cdc686fc4e9d93ad76eafe36.exe
Resource
win10-20240404-en
General
-
Target
3911d35f21aa834cc70c2cf0a57e5453e00a49f0cdc686fc4e9d93ad76eafe36
-
Size
3.3MB
-
MD5
6546bf929ad7aac40c4cae7ce807adcc
-
SHA1
f6af34dc3be6d7b8808e3c953dab5fea91823c95
-
SHA256
3911d35f21aa834cc70c2cf0a57e5453e00a49f0cdc686fc4e9d93ad76eafe36
-
SHA512
ac7d076e9724e93a29465915f7c0b0d560bfd897781aeb1593f2727adb615c3807777df5d5e2398a0921e3b02deda088dde49795361726675cc8060d41f8de40
-
SSDEEP
49152:0K+rmzucNgOOaksGnU/GwW+7Tof4CAj+yioIlB/0saJ++uPRD8Mce77H175ND:0vmqcvdkQ/WgMf9Aj+yc+o8m7xnD
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3911d35f21aa834cc70c2cf0a57e5453e00a49f0cdc686fc4e9d93ad76eafe36
Files
-
3911d35f21aa834cc70c2cf0a57e5453e00a49f0cdc686fc4e9d93ad76eafe36.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 581KB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 111KB - Virtual size: 214KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 2KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 98KB - Virtual size: 98KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 21KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.themida Size: - Virtual size: 4.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ