Behavioral task
behavioral1
Sample
b6aQ59sOz3kD.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
b6aQ59sOz3kD.exe
Resource
win10v2004-20240802-en
General
-
Target
b6aQ59sOz3kD.exe
-
Size
36.3MB
-
MD5
87115d2a3e5461780748f8fb95b37104
-
SHA1
2411ecce2802c6b494c0ddc2de11672a5185f88e
-
SHA256
23be9c24ad81c8f5404be2cc5678423675d3e48f549c529c4e4b350e700740e0
-
SHA512
f099e6bf0f68be7292c1782df683c7c2a13352fe24437ab4ba736d247a80ba1f04e901e8974d0fb30476793f6076ff48fee9eb2a54fb83c7de3e3f19277a5231
-
SSDEEP
786432:Fn8cqpDkDog+OjZ6ld4ZCCW3l9d3lGBndv0vLmY:Fn0DkDYd4ZCdlRK0vLmY
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b6aQ59sOz3kD.exe
Files
-
b6aQ59sOz3kD.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 437KB - Virtual size: 827KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 118KB - Virtual size: 330KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 387KB - Virtual size: 453KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 23.2MB - Virtual size: 23.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 2KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 20.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 12.1MB - Virtual size: 12.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 16B - Virtual size: 4KB
IMAGE_SCN_MEM_READ