Behavioral task
behavioral1
Sample
95e49010863093db2845934bab0a8843f45ed4734fc901f86334acdbd3f6e92f.exe
Resource
win7-20240903-en
General
-
Target
95e49010863093db2845934bab0a8843f45ed4734fc901f86334acdbd3f6e92f
-
Size
2.6MB
-
MD5
415716088b2bb8f37998b4465e67a056
-
SHA1
8eba6d7952bab3f6ecd18b2e8c468d11c8c1eb43
-
SHA256
95e49010863093db2845934bab0a8843f45ed4734fc901f86334acdbd3f6e92f
-
SHA512
c4a3c521614894fcb2484944f29850ef47316e384b156fb7e6bccd05da8e4030c6ccda296dc179b50a1edf9efbcd3cf9a5d5b38dde6978c6d8aaae3dc8621c76
-
SSDEEP
49152:WWQI6MkIeLhkDgxoBTYam+0p0TnA8YCnEvJyzyLDZrGEb7CAuN:PulL6gxeYah0piACnEvJyOLD9GEbWv
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 95e49010863093db2845934bab0a8843f45ed4734fc901f86334acdbd3f6e92f
Files
-
95e49010863093db2845934bab0a8843f45ed4734fc901f86334acdbd3f6e92f.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 30KB - Virtual size: 65KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 6KB - Virtual size: 81KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.themida Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ