Behavioral task
behavioral1
Sample
Serialcheckers.rar
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
Serialcheckers.rar
Resource
win10v2004-20240802-en
General
-
Target
Serialcheckers.rar
-
Size
14.9MB
-
MD5
ed4e85eda3e193535e521b9f1aa7813b
-
SHA1
d78666dc2aca7fc9cc1fbbb2a2113b73ad7232a9
-
SHA256
0686eaac70ac59f895f8e49bfb61e6576a53f8949ec611cd564d8cd5cfb9479d
-
SHA512
626f9b264b35637e0a13bb6604dc793801ed35e0c9907c00a284f60e3aa2f112b085536ac5c97b0b8a04460e1c1ca3c4f4f84a44ffe424180118b91dc879f7f7
-
SSDEEP
393216:BLlSKvJN/Kavoqw65ColJ/iVui6FnwyQqc/ShCS+WJ8MyWd:BLlSKBNnvoqw6V3/iVuDJGnDWJjd
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Mac-checker.exe themida -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Mac-checker.exe unpack001/Serialchecker.exe
Files
-
Serialcheckers.rar.rar
Password: yes
-
Mac-checker.exe.exe windows:6 windows x64 arch:x64
Password: yes
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 41KB - Virtual size: 84KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 9KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 260B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 7.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 4.3MB - Virtual size: 4.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
-
Serialchecker.exe.exe windows:4 windows x86 arch:x86
Password: yes
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 10.5MB - Virtual size: 10.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 118KB - Virtual size: 117KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
macAddresses.json
-
oldserials (keep me).json