Behavioral task
behavioral1
Sample
KamiLib_Release.Free.2024_protected.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
KamiLib_Release.Free.2024_protected.exe
Resource
win10v2004-20240709-en
General
-
Target
KamiLib_Release.Free.2024_protected.exe
-
Size
99.4MB
-
MD5
230abb06a99a3b887a2bccbb16cb1e13
-
SHA1
2ef537a98a3d52b934baac7e76bd4b89c05482b7
-
SHA256
a032abb0ebb78e898801a8235c3cfa9b49cf5ad0b551aaf07da7412e3031bfe5
-
SHA512
515dfcb2eb2a9dfb04dc72dddd7f6bd10687166d47760d3da61e32780fe12ddbadc82da76b29219e9e4eb2a3c82c778f2b42a13730995f00e06ffe02d7c8f934
-
SSDEEP
3145728:DWfyMo6rM5jq2AA+4pgJdtw9msJ/nwSWgpRQR:DWfy0qjjpgJXAmsnW8R6
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource KamiLib_Release.Free.2024_protected.exe
Files
-
KamiLib_Release.Free.2024_protected.exe.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 95.9MB - Virtual size: 95.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 37KB - Virtual size: 171KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 172KB - Virtual size: 172KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 3.3MB - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ