OracleOracle-type3[.]3[.]9[.]7[.]exe

General

Target

OracleOracle-type3.3.9.7.exe
Size

845.7MB
MD5

09487151738351663ca03ab759e4e5b2
SHA1

ecdacc685e94e99a8698a388d40e9a1d655ed1ea
SHA256

49f72997aac88358a1e197d5d2e8e058502155f7e5c65b2c13928e72718e7773
SHA512

cff1a04629eab37b6bad2c32adde5fd1ca9d8c956896749713ba5353f3658dd303c613dff2ee46b85d07e83ae2e25671460787257aadc504754a7a776403e9ea
SSDEEP

12582912:ACmjUusxHC00oY5z3A74m0IYbZU5ohTAcVdiIEDGzpvH5atLl2ild2m3I215HY8:AMusgTZNNUEXi/chaLP2e1df

Score

7^/10

upx themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
static1/unpack001/out.upx	themida

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

OracleOracle-type3.3.9.7.exe
.exe windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

UPX0
Size: - Virtual size: 2.1MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.text
Size: 934KB - Virtual size: 934KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 192KB - Virtual size: 192KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.themida
Size: 3.9MB - Virtual size: 3.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 2.1MB

UPX1 Size: 3.0MB - Virtual size: 3.0MB

UPX2 Size: 512B - Virtual size: 4KB

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 934KB - Virtual size: 934KB

.rdata Size: 192KB - Virtual size: 192KB

.data Size: 5KB - Virtual size: 65KB

.pdata Size: 12KB - Virtual size: 11KB

_RDATA Size: 512B - Virtual size: 348B

.reloc Size: 3KB - Virtual size: 2KB

.idata Size: 512B - Virtual size: 4KB

.themida Size: 3.9MB - Virtual size: 3.9MB

UPX0
Size: - Virtual size: 2.1MB

UPX1
Size: 3.0MB - Virtual size: 3.0MB

UPX2
Size: 512B - Virtual size: 4KB

.text
Size: 934KB - Virtual size: 934KB

.rdata
Size: 192KB - Virtual size: 192KB

.data
Size: 5KB - Virtual size: 65KB

.pdata
Size: 12KB - Virtual size: 11KB

_RDATA
Size: 512B - Virtual size: 348B

.reloc
Size: 3KB - Virtual size: 2KB

.idata
Size: 512B - Virtual size: 4KB

.themida
Size: 3.9MB - Virtual size: 3.9MB