CHAPRI VIP_Cracked[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

CHAPRI VIP_Cracked.exe
Size

4.1MB
MD5

fe73f3e45b6f8f944f80c25abb73950a
SHA1

259873bc079e848106efd37622ecb72d3f3644bd
SHA256

d15422376601dedac214f7f783c64dc743ecbffcfcbb752441cea1c73c350ede
SHA512

c31194b1ea5723daa6b763e34a9558fcd1b8024ff19d9d19687fa4c893fc83a0961e08b60b483d7077da7050b948f6a875c6f6cb193621e92cb163f93ea8fccd
SSDEEP

98304:aO11QuUqi/zO923Sm1ONDHCotPDtWv54cterP/:a4VUqUzOc3H1ONjCAi5luP/

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Files

CHAPRI VIP_Cracked.exe
.exe windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Size: 12KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 561B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.imports
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 7.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 4.0MB - Virtual size: 4.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ