Behavioral task
behavioral1
Sample
SecuriteInfo.com.BScope.Trojan.Agent.9725.20858.dll
Resource
win7-20240705-en
General
-
Target
SecuriteInfo.com.BScope.Trojan.Agent.9725.20858.dll
-
Size
8.5MB
-
MD5
7c797a2c0a8188ab16de2bff9ed4703e
-
SHA1
92693c9c0a1a129caad4fc792c788dddd8e705bc
-
SHA256
f93358bdea63a339b1547f2f263382192c881f8bca0c43a0e7e27416551a4ce0
-
SHA512
9a9334e34f303f9409ce8575b13aa1c8a03ea4cc4067beea44ae0555c33c7764d500c73007d171f9e84e9fa488d6baf764b8b708579a490090b67ce16224d3eb
-
SSDEEP
196608:0zZQUMcVA06QgIvyrD4cDif9+rERUxxoEZsMCs6b1vY39tmSP:0zZIMA0eUy/4Ai1+fnNdCHbVYR
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource SecuriteInfo.com.BScope.Trojan.Agent.9725.20858.dll
Files
-
SecuriteInfo.com.BScope.Trojan.Agent.9725.20858.dll.dll windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sections
Size: 1.6MB - Virtual size: 3.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 792KB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 3.3MB - Virtual size: 3.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 159B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 131KB - Virtual size: 193KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.imports Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 4.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 2.6MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 16B - Virtual size: 4KB
IMAGE_SCN_MEM_READ