Behavioral task
behavioral1
Sample
6d456977f4d338c27ace3a30a24d10959c27101326bb015300059ed5ca6f57b8.dll
Resource
win7-20240221-en
General
-
Target
2d50abb15c4fbb426826c2bd0dfdaf61.bin
-
Size
4.7MB
-
MD5
606456fd23fefee3f646dd3a3c1dc3f8
-
SHA1
044a10d2415b9e7ed1fd4744639925149e6812cc
-
SHA256
c5ed5b21d36910a85b0211b15f2ec37951801518ba1ea4cb801f14526fb23201
-
SHA512
5ebbd1e7bc1c9f4f8e31973d57cd18945ec8c1186237e064e781c7b474034a824a2db81a76f05d9c771025ce3682a44199f907f1ca8d7b14e13caa184bad6a48
-
SSDEEP
98304:69PVAHN8MNP9w4eyxogupgwbdq9RcsSDUgVesp:wVwN3NPy4ekIRbGmsmZ
Malware Config
Signatures
-
resource yara_rule static1/unpack001/6d456977f4d338c27ace3a30a24d10959c27101326bb015300059ed5ca6f57b8.dll themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/6d456977f4d338c27ace3a30a24d10959c27101326bb015300059ed5ca6f57b8.dll
Files
-
2d50abb15c4fbb426826c2bd0dfdaf61.bin.zip
Password: infected
-
6d456977f4d338c27ace3a30a24d10959c27101326bb015300059ed5ca6f57b8.dll.dll windows:6 windows x86 arch:x86
Password: infected
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sections
Size: 1.3MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 510KB - Virtual size: 957KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 104KB - Virtual size: 375KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 6KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 87KB - Virtual size: 126KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 4.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 16B - Virtual size: 4KB
IMAGE_SCN_MEM_READ