Behavioral task
behavioral1
Sample
1559ae6852cea47c7bd0333c90c6c9617824685bad459e3f85d306debf4e0708.exe
Resource
win7-20240705-en
General
-
Target
1559ae6852cea47c7bd0333c90c6c9617824685bad459e3f85d306debf4e0708
-
Size
4.4MB
-
MD5
c730fda0fc1a87e2a15ac189fa8630e5
-
SHA1
7cc42fe1c037510cb43d2c8225665beabfc35ab4
-
SHA256
1559ae6852cea47c7bd0333c90c6c9617824685bad459e3f85d306debf4e0708
-
SHA512
9ee3d5632c7ac00d7b26dda69b36b3aaadf3d2aa9a609806457928f559d1e9e2a2944d8ed4d66e399f2c63b106bb6720d33e5cc9700ecd6dc927b7d0fe895706
-
SSDEEP
98304:vBQYmq6yLXeXtGOAB/uwC9zDCSKCMJwnkrXO4:JZGtGbpz8zDjcckrZ
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1559ae6852cea47c7bd0333c90c6c9617824685bad459e3f85d306debf4e0708
Files
-
1559ae6852cea47c7bd0333c90c6c9617824685bad459e3f85d306debf4e0708.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 792KB - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 76KB - Virtual size: 325KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 100KB - Virtual size: 702KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 852KB - Virtual size: 942KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 8KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 4.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 2.6MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ