Behavioral task
behavioral1
Sample
20c0746d244094badac2caf11a493012d0520d9bcc150525e6259163ba204d8e.exe
Resource
win7-20240903-en
General
-
Target
20c0746d244094badac2caf11a493012d0520d9bcc150525e6259163ba204d8e
-
Size
6.4MB
-
MD5
fbedc361713c66771b45e217c05c4906
-
SHA1
93f4285f41f6e295bfa23740d057b2949efa7c57
-
SHA256
20c0746d244094badac2caf11a493012d0520d9bcc150525e6259163ba204d8e
-
SHA512
1ec8ffca1594cec034f02a0e31dd2396e377b9e9bf63dd85b951d63b3a17617d6e274c144c2f9a96dba9161a45cbf8fef1a7082061113855c5650b00b0683d7d
-
SSDEEP
196608:YDjMakB55dJ0mjsIAEWRresa6vzRm3gsppe:8W5H0mjsIAExsa6vzU3gse
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 20c0746d244094badac2caf11a493012d0520d9bcc150525e6259163ba204d8e
Files
-
20c0746d244094badac2caf11a493012d0520d9bcc150525e6259163ba204d8e.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 396KB - Virtual size: 848KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 3.4MB - Virtual size: 3.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 32KB - Virtual size: 341KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 56KB - Virtual size: 154KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 140KB - Virtual size: 140KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ