Behavioral task
behavioral1
Sample
u8f9cWaFtUDr57.exe
Resource
win7-20240903-en
General
-
Target
u8f9cWaFtUDr57.exe
-
Size
10.4MB
-
MD5
4e646bc1940593411dcf0041d867e3c6
-
SHA1
b17cbe59690037d337165a802d477863c01f9d5a
-
SHA256
1bd906427960f134ca6c9b36a608cd9a20e66181ac9b47a2b01d4d4cc3674e1c
-
SHA512
d0674f126e46f2b9bd95080976d4ae00a0e276eecc66944ec8f3fc8120b3540384db112ceec2a526daaf4b4efd8596e9c4149ed81c3965b511cf396595f8d640
-
SSDEEP
196608:oI4qfzODtjrWPibZNxN/CBPSOEzb8bOAjgzenB179F1+zQ5H:6qfCDhWsNNqRSNb8JjAeB1BF1N5H
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource u8f9cWaFtUDr57.exe
Files
-
u8f9cWaFtUDr57.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 240KB - Virtual size: 248KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 15.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 10.2MB - Virtual size: 10.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ