Behavioral task
behavioral1
Sample
8eb3a2b0c546da0b5c595cbbba207db7f990b3726075ea45f7decf57b863f5bb.exe
Resource
win7-20240508-en
General
-
Target
8eb3a2b0c546da0b5c595cbbba207db7f990b3726075ea45f7decf57b863f5bb.exe
-
Size
28.4MB
-
MD5
f3c5a2f7998dda93df0ffce490040183
-
SHA1
cb6555cff3334f9415c542496de591a95c6ac325
-
SHA256
8eb3a2b0c546da0b5c595cbbba207db7f990b3726075ea45f7decf57b863f5bb
-
SHA512
8a7d8dc45f1d9a525082bc97cb5fea87de07f22554825a613f0ea0f311eae702e4b2286a11af67d7d5273bc4d844f5bef25c64b4ae4793777c1383276e31b560
-
SSDEEP
393216:ABXfXgSZvx+hS9yZC7g8eQkmIGWyYFNLF/H0ef91mAHj16obsHQlKfjDUcC0K/Zg:AlQavMw9yZOfgc8pfr/sHjUx7VqXu4l
Malware Config
Signatures
-
Detects executables packed with Themida 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_Themida -
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8eb3a2b0c546da0b5c595cbbba207db7f990b3726075ea45f7decf57b863f5bb.exe
Files
-
8eb3a2b0c546da0b5c595cbbba207db7f990b3726075ea45f7decf57b863f5bb.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 44KB - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 18KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 47.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 28.3MB - Virtual size: 28.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ