Behavioral task
behavioral1
Sample
WinRAR.exe
Resource
win7-20240903-en
General
-
Target
WinRAR.exe
-
Size
3.7MB
-
MD5
64db33a2b5ff5f8d6e5fee1049feaf5a
-
SHA1
6dfc63394fdd0e382a4bc12e64fb33e2935b625b
-
SHA256
1f2d6fbfab49df5e43008cd7fa1487fdf0ed57fc9c934bb8e8f2ee45de2d6dd7
-
SHA512
a4f015845d8b0ce15f43a7e7db815e1a20f3bf94f019057e5e5af8f4f750a18b7e05d84fdca2a27b3faec17ffdce32ca70377df17d1059adc86da7c69b0ee0c1
-
SSDEEP
98304:6geXlR2/r/+5KoeJFUcPfFb/HYX4xkA2FWLT:iVozm5KoUFhf1/HWCl2oLT
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource WinRAR.exe
Files
-
WinRAR.exe.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 35KB - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 119KB - Virtual size: 166KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 166KB - Virtual size: 166KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 3.3MB - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ