Yams_Services_External[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

Yams_Services_External.exe
Size

3.5MB
MD5

4240b6c1ab4629acc3927253194bb347
SHA1

2dd45eca03940f3ec406a41dab511aff46b12f28
SHA256

d3084cfdaaddce936b27ab95f651c27633938ae844b7858d3871bbc56b4437b2
SHA512

4998f70111505b755710b2eafd13e2c52b95ab68cdd15ab82c4d6b46c0388a0d72b03206b2074364a824c3e92265c4c6c34083b8e876c7b1f41e02d5818be435
SSDEEP

98304:aJcv8AMTa1spzA7IcKgoUxdu+/y8QTrCsGT:e0EA7X4Uxdx/y8dT

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Files

Yams_Services_External.exe
.exe windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Size: 135KB - Virtual size: 284KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 26KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 1002B - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 7KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 47KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 405B - Virtual size: 476B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.imports
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 5.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 3.2MB - Virtual size: 3.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 16B - Virtual size: 4KB

IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

Size: 135KB - Virtual size: 284KB

Size: 26KB - Virtual size: 61KB

Size: 1002B - Virtual size: 6KB

Size: 7KB - Virtual size: 14KB

Size: 47KB - Virtual size: 87KB

Size: 405B - Virtual size: 476B

.imports Size: 1KB - Virtual size: 4KB

.tls Size: 5KB - Virtual size: 8KB

.rsrc Size: 44KB - Virtual size: 44KB

.themida Size: - Virtual size: 5.7MB

.boot Size: 3.2MB - Virtual size: 3.2MB

.reloc Size: 16B - Virtual size: 4KB

.imports
Size: 1KB - Virtual size: 4KB

.tls
Size: 5KB - Virtual size: 8KB

.rsrc
Size: 44KB - Virtual size: 44KB

.themida
Size: - Virtual size: 5.7MB

.boot
Size: 3.2MB - Virtual size: 3.2MB

.reloc
Size: 16B - Virtual size: 4KB