Behavioral task
behavioral1
Sample
AsProgrammeroutprotected.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
AsProgrammeroutprotected.exe
Resource
win10v2004-20240802-en
General
-
Target
AsProgrammeroutprotected.exe
-
Size
34.7MB
-
MD5
969e5d2784440716dc2561999ad03e4a
-
SHA1
0f62361615c6504e14e1e12a138c3f7f9fb5ec35
-
SHA256
522f8ba52ee45fdab6f7cfce51c27c4ef0351438a4d20fa18a302efd4c9aa2db
-
SHA512
d39449678016713b922beda3a7d766065b3afdcc3b4f6d07600ce19f404da70dff9cf9f8444cdeab2c58db3bbe2110ce80cca18bdf0362bdb6f4597bbd40d7d2
-
SSDEEP
786432:Vu+a9UsWGhsFu7REPVxHl8DZ4ZYVyqJ5u/US:wRfl+PbFsdVyq+cS
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource AsProgrammeroutprotected.exe
Files
-
AsProgrammeroutprotected.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 27.3MB - Virtual size: 27.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.imports Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.themida Size: 7.4MB - Virtual size: 7.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE