Behavioral task
behavioral1
Sample
9703bbdda3662aaf15fc1560755018d7eb1c6c9e4ef32f6404cf67f28f9cf281.exe
Resource
win7-20240220-en
General
-
Target
9703bbdda3662aaf15fc1560755018d7eb1c6c9e4ef32f6404cf67f28f9cf281
-
Size
1.7MB
-
MD5
41ad0676b1c31f977991d464b09bc462
-
SHA1
33aa733131e31ec6b51959c695efc01571c5d94f
-
SHA256
9703bbdda3662aaf15fc1560755018d7eb1c6c9e4ef32f6404cf67f28f9cf281
-
SHA512
9973691e4bcbceb8bfa60aef6588a37d8b6458d05366f8f3c36e1ed5c6c7eba3f03c61938cd477b4ac76fbfcd2c0ecb7280f63940a93621d627f550903eb8db1
-
SSDEEP
49152:1xsM/zxjlW0iIgkzp8QocLJoBut4BCtyJyZVF2c:1HbxzijmiWJRtnh2c
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9703bbdda3662aaf15fc1560755018d7eb1c6c9e4ef32f6404cf67f28f9cf281
Files
-
9703bbdda3662aaf15fc1560755018d7eb1c6c9e4ef32f6404cf67f28f9cf281.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 139KB - Virtual size: 313KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 21KB - Virtual size: 71KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 2KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 12KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.vm_sec Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 16B - Virtual size: 4KB
IMAGE_SCN_MEM_READ