Behavioral task
behavioral1
Sample
2024-06-01_bd353415c5047c95a115ab099798f487_megazord.exe
Resource
win7-20240508-en
General
-
Target
2024-06-01_bd353415c5047c95a115ab099798f487_megazord
-
Size
15.5MB
-
MD5
bd353415c5047c95a115ab099798f487
-
SHA1
9ee8b880bf2e4b635f6bcfac3e9d3128bb346422
-
SHA256
3d72e65b8a4bf701354ed3aae5681d1e959a655557f1276cd2a59d352ffec3af
-
SHA512
93f0726949367277ac0cc12fcc4a21eca8dfb9f7f9b936509cb059ab570b937ffe6c288100920fc9dba6a7b7129b30060e75a3e705ee1dd57a34526261760b52
-
SSDEEP
393216:NM540VWIe12hiCNzprCLM2dMy7UcQbc59kotDwyj:NM540V/e1YCLM2dMyIcQbc59kotDwyj
Malware Config
Signatures
-
Detects executables packed with Themida 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_Themida -
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-06-01_bd353415c5047c95a115ab099798f487_megazord
Files
-
2024-06-01_bd353415c5047c95a115ab099798f487_megazord.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 6.3MB - Virtual size: 6.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 339KB - Virtual size: 338KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 76KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.imports Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 1024B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.themida Size: 6.1MB - Virtual size: 6.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 16B - Virtual size: 4KB
IMAGE_SCN_MEM_READ