Behavioral task
behavioral1
Sample
New Text Document.txt
Resource
win10v2004-20240426-en
Behavioral task
behavioral2
Sample
New Text Document.txt
Resource
win11-20240426-en
Behavioral task
behavioral3
Sample
msedge.exe
Resource
win10v2004-20240508-en
General
-
Target
Downloads.zip
-
Size
3.5MB
-
MD5
03b27fbc39e3bb450ed901b7b6261f93
-
SHA1
f5ae10c2eff97781725659f9af7dddfbebbeb52a
-
SHA256
c5942a8e38529bf1ab9f1a88b874b0ca1c026c87bc0d1b9730e78195a7f5b3d7
-
SHA512
ba8ed7e8419948431af943216e5eef19626a0144785adad7b8e0a70c7b9888d3531266147a4d468231b8cb475be0c9b9e62d3004575d4640b7876155f44eee68
-
SSDEEP
98304:AnrOsNkb44/ArhRYdkJ5wAlEph4x4eNjEjZKQ9qKmk1BI5:AnrSyPwEEpaxAik1BI5
Malware Config
Signatures
-
resource yara_rule static1/unpack001/msedge.exe themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/msedge.exe
Files
-
Downloads.zip.zip
-
New Text Document.txt
-
msedge.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 220KB - Virtual size: 446KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 38KB - Virtual size: 106KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 812B - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 10KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 275B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.imports Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 3.3MB - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 16B - Virtual size: 4KB
IMAGE_SCN_MEM_READ