Behavioral task
behavioral1
Sample
njmE5JrJlyTh.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
njmE5JrJlyTh.exe
Resource
win10v2004-20240802-en
General
-
Target
njmE5JrJlyTh.exe
-
Size
38.3MB
-
MD5
0d8700c0039258c9b08713920c0290e3
-
SHA1
5fa2e8551bc2eaf038acc356e913b64b5206ca50
-
SHA256
acc68938209e4ae0c6adba83559591beff78e911b7c4bdc75e5c398399b04f1b
-
SHA512
13f5d1c8711947693c0482af011fdd0bf9df091db135f82cb56df7c87dca0e4abb9ed71ffe50c1091dbaf70584cfed8b17fa60957a078046ff942f5f079cf9a7
-
SSDEEP
786432:+uUAm6vPiJQXNFCCpF+1AWUvxx2P4z1UE4LKozt3sJxIUHn:+7KicNFCta1xxOWKfzIB
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource njmE5JrJlyTh.exe
Files
-
njmE5JrJlyTh.exe.exe windows:6 windows x64 arch:x64
Password: Forrespelare2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 437KB - Virtual size: 827KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 118KB - Virtual size: 330KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 387KB - Virtual size: 453KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 23.2MB - Virtual size: 23.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 2KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 23.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 14.1MB - Virtual size: 14.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 16B - Virtual size: 4KB
IMAGE_SCN_MEM_READ