General
-
Target
c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe
-
Size
4.3MB
-
MD5
b162133322f47da52b67dab3f9b3b21e
-
SHA1
2c2ff9390bb11ae1f62a3973cf97d39be150639d
-
SHA256
c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1
-
SHA512
71548751c2094aa5b27228198541487616dda78b8f06239188cc57b2509903b7d1b5ca00447363e0a1cbe504eb72ce05dbcff258aac5d50d3e366dec32ec4491
-
SSDEEP
24576:qmkYu1/Al/K6eVhA0mNC301+S45EcnlqZBU6jWUSiQoaUl4IZlWQyhvAYtkEwrSX:qmkYu1/AlC6o01qE46DZlxgXIf44cl
Malware Config
Signatures
-
Processes:
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe
Files
-
c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 32KB - Virtual size: 72KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 199KB - Virtual size: 198KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.themida Size: 4.1MB - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE