Behavioral task
behavioral1
Sample
6a45ce24eb5ed2601c158074984ccf821432e2a6f81706954ca7a0023d159545N.exe
Resource
win7-20240708-en
General
-
Target
6a45ce24eb5ed2601c158074984ccf821432e2a6f81706954ca7a0023d159545N
-
Size
10.0MB
-
MD5
46e728f6ab743519b02ddfb039769900
-
SHA1
d9954df340569df6c261e0850f1d6c3ac5ce92f5
-
SHA256
6a45ce24eb5ed2601c158074984ccf821432e2a6f81706954ca7a0023d159545
-
SHA512
020e99ec1a35ce597448ebd351e35d79d5fa388a6412df0697e4b776495ac6034c495afe22609e7ff1bebca6232212f17172d580e09a5c28d1f9b193bfb44ca8
-
SSDEEP
196608:ENbdYy0TIeimNM0aKG3xiJqAwlaPWz5Sh83Qm1lJto0y7OI2NEWkY4JU1wF1l7:Ez5eIeimNM0U36qAwE8G2QkJfIXrdPP
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6a45ce24eb5ed2601c158074984ccf821432e2a6f81706954ca7a0023d159545N
Files
-
6a45ce24eb5ed2601c158074984ccf821432e2a6f81706954ca7a0023d159545N.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 1.6MB - Virtual size: 4.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3.7MB - Virtual size: 4.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 1.6MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 16KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 3.0MB - Virtual size: 3.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ