Behavioral task
behavioral1
Sample
Precise Temp.exe
Resource
win7-20240903-en
General
-
Target
Precise Temp.exe
-
Size
4.5MB
-
MD5
6509b704aa9ebb7452bc4a77b18a9e9e
-
SHA1
91bb981b702e16913af49a0e59f64da025bb3af8
-
SHA256
86e6fab2b9c9a219365a962076ddb69f947ec1f35e971703b0ed6cb4da528225
-
SHA512
38e6e578f262afe2ecdeedb1bb5103f68c9a61714eb71a494578ff104a2195fca4176e2820c786b7f2907fd6d7ed655684cbf558fed829b445efc6a8b734bfdb
-
SSDEEP
98304:TX+roAWebtAIaAgq9uAmb7YJrr9/xFJ4E1ZI+9dUbEhP1X:yrxZtXadOG+Pzh
Malware Config
Signatures
-
Processes:
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource Precise Temp.exe
Files
-
Precise Temp.exe.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 1.2MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 3.2MB - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ