Behavioral task
behavioral1
Sample
d678754f5be76296e0b868928b6edde930c3ffcac648ce277b7607aa38f47373.exe
Resource
win7-20240903-en
General
-
Target
d678754f5be76296e0b868928b6edde930c3ffcac648ce277b7607aa38f47373
-
Size
3.6MB
-
MD5
8347273bb914c0b9c5388e7332a31488
-
SHA1
274670e5e03ddeae48375569ef51f92ba8232b8f
-
SHA256
d678754f5be76296e0b868928b6edde930c3ffcac648ce277b7607aa38f47373
-
SHA512
3288a57f3c8f06f51e770ffea65581ea59b043fe5001253e7ffe5d83a7402345df44cc66de7684427695a1e95734f8377e0bc85f7accd3727d5d9c5f65650b9a
-
SSDEEP
98304:gNsMfaN0MrQ/XOajXhWh8u80vnAuouROB8GrNNf+K8hTKa/CaGFp5:isMqGOajXhW2u3vA6UBrpND4jaa
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d678754f5be76296e0b868928b6edde930c3ffcac648ce277b7607aa38f47373
Files
-
d678754f5be76296e0b868928b6edde930c3ffcac648ce277b7607aa38f47373.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 1019KB - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 88KB - Virtual size: 268KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 38KB - Virtual size: 23.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 19KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ