Behavioral task
behavioral1
Sample
1f222b05e4e13baa0ac42ea950efe911e356c337c4a137bcc1c2ac8c6eafcece.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
1f222b05e4e13baa0ac42ea950efe911e356c337c4a137bcc1c2ac8c6eafcece.exe
Resource
win10v2004-20240508-en
General
-
Target
1f222b05e4e13baa0ac42ea950efe911e356c337c4a137bcc1c2ac8c6eafcece
-
Size
6.5MB
-
MD5
e4bf893d1199e374cc36a879e6e50318
-
SHA1
709ba5a6a7f5cb0d563e7517448a8850e7a17138
-
SHA256
1f222b05e4e13baa0ac42ea950efe911e356c337c4a137bcc1c2ac8c6eafcece
-
SHA512
1e9aa6669906bd375aba6f6f9ff138f8ad404b1c060331a5bf664350bd162dc865da26d11362f284cd4a1d4b128fb0180afce7e0b06b5c7ca52e743f8530e204
-
SSDEEP
196608:Kfq+XwNcFL1feIEX2uxempqGXov+RSHciKANTN5nfzE:Sq+XwNcJEX2uEmpJogZMN5nLE
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1f222b05e4e13baa0ac42ea950efe911e356c337c4a137bcc1c2ac8c6eafcece
Files
-
1f222b05e4e13baa0ac42ea950efe911e356c337c4a137bcc1c2ac8c6eafcece.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 645KB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 97KB - Virtual size: 270KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 191KB - Virtual size: 360KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 41KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.themida Size: - Virtual size: 7.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 16B - Virtual size: 4KB
IMAGE_SCN_MEM_READ