Behavioral task
behavioral1
Sample
5e4fda8d655a3599443a8a5d470332e2eb152afda796a834591e09d057713192.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral2
Sample
5e4fda8d655a3599443a8a5d470332e2eb152afda796a834591e09d057713192.exe
Resource
win11-20240426-en
General
-
Target
5e4fda8d655a3599443a8a5d470332e2eb152afda796a834591e09d057713192
-
Size
1.8MB
-
MD5
5d961f1cd815b9c7fabde15ac1b4a0ff
-
SHA1
31ed01d1cad7e68581f879e7c2b02b62c89586fd
-
SHA256
5e4fda8d655a3599443a8a5d470332e2eb152afda796a834591e09d057713192
-
SHA512
3962d8300bd3b3e4951455c4ca4244e06d7947384107123ff708d6cdb5f306aa462ed5f9d1099d7b0ff764061d6bd9d03c405b7abad1d7031ae671ed46335210
-
SSDEEP
49152:oFSUl/3cN+OdDfHSzWdf35Li8gf4MhsPdbHz:+j/sN+SlfpLi72d3
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5e4fda8d655a3599443a8a5d470332e2eb152afda796a834591e09d057713192
Files
-
5e4fda8d655a3599443a8a5d470332e2eb152afda796a834591e09d057713192.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 512KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 49KB - Virtual size: 159KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 2KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 28KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 19KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.vm_sec Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 50KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 16B - Virtual size: 4KB
IMAGE_SCN_MEM_READ