OPENSSL_Applink
Behavioral task
behavioral1
Sample
207a8b50-bb60-45c1-bdca-e266246f4582.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
207a8b50-bb60-45c1-bdca-e266246f4582.exe
Resource
win10v2004-20240802-en
General
-
Target
207a8b50-bb60-45c1-bdca-e266246f4582.exe
-
Size
7.5MB
-
MD5
a37062c49e237a9837c77e2b1b4f2c14
-
SHA1
5e281abf8521de54395405012e53057c178d85f6
-
SHA256
374ba36753d3cc17ed6a2d49087519eb0f7a0095f741eeb2a7ab7aa9c1246553
-
SHA512
52e1fd21c076773bf6b0e2ed04bd7d5f62bd94a861341aad71edd997ed8be4f32a0c1902e05f619680227c491eae41575f80f6fb0e1c224dbf74c2495e4e9ea4
-
SSDEEP
196608:qtEP6roy/1tiIFynT/kXIv4c5mAIOK9+LnuSChP8HX:qkIKT/H7IIqhUHX
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 207a8b50-bb60-45c1-bdca-e266246f4582.exe
Files
-
207a8b50-bb60-45c1-bdca-e266246f4582.exe.exe windows:6 windows x64 arch:x64
Password: ray
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 1.8MB - Virtual size: 4.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 449KB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 1.4MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 96KB - Virtual size: 166KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 22KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.edata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 3.7MB - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 16B - Virtual size: 4KB
IMAGE_SCN_MEM_READ