Behavioral task
behavioral1
Sample
c6c57a03e14a28572a697f156f97ed5ac60663ec1271c754756dd335b21e9fed.exe
Resource
win7-20240508-en
General
-
Target
c6c57a03e14a28572a697f156f97ed5ac60663ec1271c754756dd335b21e9fed
-
Size
6.6MB
-
MD5
02a7189dbb81604690c8bac9f0946557
-
SHA1
605863a7426bc3207ea2bf7d7b01ce06f0edfd8e
-
SHA256
c6c57a03e14a28572a697f156f97ed5ac60663ec1271c754756dd335b21e9fed
-
SHA512
4c2812b2a1f73cc90fd3b86adf9533a0af2c1e86f282c8ca8ab977ff87fbb5ebdc36f4d3524022f447239fbb2045eb61e37c2f8ad3863edd2dedad1bc368c6e2
-
SSDEEP
98304:MAUH/O2fXSA57UpdRCufM4aJGTbbIl1+LxF7cg2CGABvoVPyuqyACXfTFY1uIb:MAUHl557ZucJI/xag9ckyRLmhb
Malware Config
Signatures
-
Processes:
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource c6c57a03e14a28572a697f156f97ed5ac60663ec1271c754756dd335b21e9fed
Files
-
c6c57a03e14a28572a697f156f97ed5ac60663ec1271c754756dd335b21e9fed.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 276KB - Virtual size: 497KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 3.7MB - Virtual size: 7.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 24KB - Virtual size: 146KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 4.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ