General
-
Target
updater.exe
-
Size
6.1MB
-
MD5
be00675212ecb96e7603354c84387ba0
-
SHA1
ee4bfb93dea04a35e15e95dbcb096f66ffa8f907
-
SHA256
e394b31b5d3530ba36cc348fab8ddf79cbe635b81c7991e93d1dec14c7076a68
-
SHA512
bd0c5c530d162c70a440a471bad345c2d1d94caf6cfeb3c3a0ae38805eb68664a8a8d349b6d867747bcdc2416da39a16efd36f29ae83f04314dc06c4097d73b4
-
SSDEEP
98304:gJIMtJix6CC7mR6jatnIC6JCfoYFu/I36GU8seJBHh9NwQYENY1yIXXrjmjyirxc:3f3C7mRP9hPfXE/5GUJWKQKFrj0rxc
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource updater.exe
Files
-
updater.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 2KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 6KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 8.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 6.0MB - Virtual size: 6.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ