iBoy-RAMDISK[.]exe | Triage

Sharing

General

Target

iBoy-RAMDISK.exe
Size

5.6MB
MD5

35f95631d7364c6d60bee2069fad198f
SHA1

7d29d46c6119eaf9a4c77fc75fa044604a8ecea9
SHA256

fda7a8139001e146d10bf72dcaac09bd6623b19a9fa677d15f7449c9d5bc8aa5
SHA512

7d12f9af26c36ff5b4c81f8eed0661a0380606af48555c97206f0453d110035e2d9c2bd1078fa1f94f24bdaeca1a576f9981ba5673516ef849cdb04beba55b7a
SSDEEP

98304:LngYL4YzyYYWO4uzXrutUH+N2WJnTwhV6kTGfCRmWQ70:LgYpGTjrut6+NncK8Gfm5d

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Files

iBoy-RAMDISK.exe
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Size: 171KB - Virtual size: 720KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 71KB - Virtual size: 315KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 15B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.imports
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 316KB - Virtual size: 316KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: 5.1MB - Virtual size: 5.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE