Behavioral task
behavioral1
Sample
f8932837c1c499c3809b64a2c21b6ff10ca9577d93c61f91283255bb36125eca.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f8932837c1c499c3809b64a2c21b6ff10ca9577d93c61f91283255bb36125eca.exe
Resource
win10v2004-20240508-en
General
-
Target
f8932837c1c499c3809b64a2c21b6ff10ca9577d93c61f91283255bb36125eca
-
Size
12.2MB
-
MD5
5a4792ef2f0dd971368c0464e59c46e0
-
SHA1
2a11941b04ac4cd22c0203944b3c7b17f28c6440
-
SHA256
f8932837c1c499c3809b64a2c21b6ff10ca9577d93c61f91283255bb36125eca
-
SHA512
b019c974e804ddd15e225f53b59205ec5d3fa3eede0859a6c282f5e06ba9df5440ed7ccb7540327ad3c8277ce22e28cc1d66535b59d120fe89c7fcb60c962d9c
-
SSDEEP
196608:6oER9Jay8L9zxBjGd/bLHtkAqlSuLJT5gvrzi0T4G:pw9JmhxB2/3HSdBYzzi0T4G
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f8932837c1c499c3809b64a2c21b6ff10ca9577d93c61f91283255bb36125eca
Files
-
f8932837c1c499c3809b64a2c21b6ff10ca9577d93c61f91283255bb36125eca.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 1014KB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 120KB - Virtual size: 386KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 12KB - Virtual size: 89KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 28KB - Virtual size: 94KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 105KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 16.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 10.9MB - Virtual size: 10.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 16B - Virtual size: 4KB
IMAGE_SCN_MEM_READ