Behavioral task
behavioral1
Sample
f38daf987d27c422027285c5a0566481236676627a13e4262f39a571704182d1.exe
Resource
win10v2004-20240426-en
General
-
Target
f38daf987d27c422027285c5a0566481236676627a13e4262f39a571704182d1
-
Size
1.6MB
-
MD5
b2fd0a753190372c5375b022fb551483
-
SHA1
26a5de5f4387c714cc994edf2afe601574068fe9
-
SHA256
f38daf987d27c422027285c5a0566481236676627a13e4262f39a571704182d1
-
SHA512
0c5d03db6a4e4998b52d0aee834047609813ac368d04e998eccd6be08ca7daff268bd4ea5dacde5ddf0f1d847c90c60aa68d2d52d4b4a4d8ba725043006cdb1c
-
SSDEEP
24576:4phpts/LEYn0dhIZjVUCo7zAdFB0WAX9ml5I3m91LW4jJkTdfW5AzFSNFtwrK:4pgfn+h8HoYdF1AAl5H91D+VW5AINFcK
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f38daf987d27c422027285c5a0566481236676627a13e4262f39a571704182d1
Files
-
f38daf987d27c422027285c5a0566481236676627a13e4262f39a571704182d1.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 139KB - Virtual size: 313KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 21KB - Virtual size: 71KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 2KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 12KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.vm_sec Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 16B - Virtual size: 4KB
IMAGE_SCN_MEM_READ