Behavioral task
behavioral1
Sample
17fc6092c8a45742db48b642d5f9e1c2c0499baa5aea5f54c68607d7bd68b162.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
17fc6092c8a45742db48b642d5f9e1c2c0499baa5aea5f54c68607d7bd68b162.exe
Resource
win10v2004-20240426-en
General
-
Target
17fc6092c8a45742db48b642d5f9e1c2c0499baa5aea5f54c68607d7bd68b162
-
Size
3.8MB
-
MD5
0f9c967ed93710c6d0fb3df8b4cd8014
-
SHA1
fe767c1f1c39f9ce9479db7d7ba9b953eb1bf39a
-
SHA256
17fc6092c8a45742db48b642d5f9e1c2c0499baa5aea5f54c68607d7bd68b162
-
SHA512
3ba624b52d1647f9cfee58c4da03f923339558bcb26f95d52f39528c1b360d29e9c957ab73f20977cd5fab2af2ebdbcab818ec363bf4e396bc121f6a6e019bde
-
SSDEEP
98304:j4sJ3U/is+v0dBlCwAyBM5QTPcfF+CJDD2rjoqSuyGK:8A3U3E0nvBgfFNCkqSgK
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 17fc6092c8a45742db48b642d5f9e1c2c0499baa5aea5f54c68607d7bd68b162
Files
-
17fc6092c8a45742db48b642d5f9e1c2c0499baa5aea5f54c68607d7bd68b162.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.Themida Size: 512B - Virtual size: 5.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.Themida Size: 3.8MB - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE