General
-
Target
14a72c8.exe
-
Size
8.0MB
-
MD5
37568ac657547d347592a9e855a77df9
-
SHA1
52b996f3579162c4e57e89d1b00182b6d5156bec
-
SHA256
a5bd139b2734ccb18a84f922e7ccdc276118318406017561e5810a1415a9c381
-
SHA512
7a16b3c3728b3191daeee060d9493a2d6c33223a41a017c7baaca10ffce0fb9ad87e55baf97922616262c55c460a2789c01198c02238043fae65caf8c8d4fbc0
-
SSDEEP
196608:q3N+3zg9aiALARAtVW8v+g5DmEsBQ9FXuwUmgGo9KJkEbq0:s+08R0wWfg1QBQ7X0P7elq
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 14a72c8.exe
Files
-
14a72c8.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 4.7MB - Virtual size: 5.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 77KB - Virtual size: 135KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 135KB - Virtual size: 135KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ