General
-
Target
Dr web cureit Nelxi Edition (1).exe
-
Size
3.3MB
-
MD5
33868f8a73a71ecc2e0f1a91de0e0dcd
-
SHA1
73a888bfddbed047db86e3d65dcd089d591a9f0c
-
SHA256
764cd8d3d3230d96ba8e9d2cb75996f7ee48616e62a61136f6b442e1c48c2336
-
SHA512
38a270f42aca79c0e84c1d29a2162f4442486d1d753889ea00ba6c18111f58930eb0e9c7f0cfb75093c5545f013c2e128aac7e2b3343d3950fae61c0d658a529
-
SSDEEP
49152:97dPlk61FHRv6JLWT6ZXxHMT3GDLJ4nooaqucqYAJbpiHaM/N0VkODF:95PlPfRviLM6ZBHc3ELJ8KJ86iGF
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Dr web cureit Nelxi Edition (1).exe
Files
-
Dr web cureit Nelxi Edition (1).exe.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 52KB - Virtual size: 80KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 3.2MB - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ