General
-
Target
RunnerSys_protected.exe
-
Size
17.2MB
-
MD5
07621700c6af0996cf45a3d04eebf72d
-
SHA1
789dcf4d965009bad086a67a57ca1375b0a520e0
-
SHA256
bedfc69962e5a357c3bf9aa5e410a2f5760f4c844974b4b8f785fd2848928580
-
SHA512
506974d5449c4ed59863563aba1177a22be736c8e285bdc75d5444c5ca51d87a665af69fcc8672298615e90290bbd1cd90411fa448882823fe4258e5f25aabb4
-
SSDEEP
393216:ayP1V/VA/mtzqHYE9xPhQpuTASC0irB5AX0zPERIQTFRvYeDWzQaWKQ:xNhG/mtzg39x0SC0irDE0WzQeDyQjKQ
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource RunnerSys_protected.exe
Files
-
RunnerSys_protected.exe.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 2.5MB - Virtual size: 6.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 20.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 14.7MB - Virtual size: 14.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ