Behavioral task
behavioral1
Sample
91b15448cc5d59b9b58e89726a86752857d8e58bbdb38148895b38beb9deb86f.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
91b15448cc5d59b9b58e89726a86752857d8e58bbdb38148895b38beb9deb86f.exe
Resource
win10v2004-20240426-en
General
-
Target
91b15448cc5d59b9b58e89726a86752857d8e58bbdb38148895b38beb9deb86f
-
Size
6.3MB
-
MD5
1b626a5cb27acc6e97c0cdc7dd3d3c85
-
SHA1
00ce41c21695f3c2f0b25f3341ba8a47be2142fb
-
SHA256
91b15448cc5d59b9b58e89726a86752857d8e58bbdb38148895b38beb9deb86f
-
SHA512
6bc55e5a7266c2f96e56a8a7fb440317d58c08e8a13b1ce73706aaede60018a59c493e7554fa000230fb146b5e8b664b9d7d5de57346ed08ccde8faaa9a216c0
-
SSDEEP
98304:SZHnudSjefElXcCONamsoFttBGzt+fGkoPHFOPSDjMIC+tt3lgUrJQYSpXPzaT3t:COi8cmnip+mPE2HlgmkXoar/54F
Malware Config
Signatures
-
Detects executables packed with Themida 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_Themida -
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 91b15448cc5d59b9b58e89726a86752857d8e58bbdb38148895b38beb9deb86f
Files
-
91b15448cc5d59b9b58e89726a86752857d8e58bbdb38148895b38beb9deb86f.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 638KB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 97KB - Virtual size: 270KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 192KB - Virtual size: 360KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 41KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.themida Size: - Virtual size: 6.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 5.4MB - Virtual size: 5.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 16B - Virtual size: 4KB
IMAGE_SCN_MEM_READ