Behavioral task
behavioral1
Sample
0eee338965a51d64e13d7f5f6aad3a481b72791356c96777caab05c7b2e2174f.exe
Resource
win10v2004-20240419-en
General
-
Target
0eee338965a51d64e13d7f5f6aad3a481b72791356c96777caab05c7b2e2174f
-
Size
1.7MB
-
MD5
897ecd1d1d951405de10095c8cdefcba
-
SHA1
dcd4849bda675bf30990853b3c4a165e4dc97f95
-
SHA256
0eee338965a51d64e13d7f5f6aad3a481b72791356c96777caab05c7b2e2174f
-
SHA512
97ab8bb43cecd8bc525b415b62b90188c0af19435403b123ca5ee2692a426e8e2c2d134126ec73a6f48e7acfd4f26a05d08079dfd8ba740558aa382fb5b135a5
-
SSDEEP
49152:vEWXIWLOaJm5fzXX/LXQH7VJ7tsUtNfej6V:E23JmzjXQJVtsUtNfe+V
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0eee338965a51d64e13d7f5f6aad3a481b72791356c96777caab05c7b2e2174f
Files
-
0eee338965a51d64e13d7f5f6aad3a481b72791356c96777caab05c7b2e2174f.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 139KB - Virtual size: 313KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 21KB - Virtual size: 71KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 2KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 12KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.vm_sec Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 16B - Virtual size: 4KB
IMAGE_SCN_MEM_READ