funnneh[.]rar | Triage

Sharing

General

Target

funnneh.rar
Size

13.3MB
MD5

0a18b09c1d8ad6fa325f1b9db8ce8a46
SHA1

4c9bd7e366fffd66f0c488e3a92f58198b61ad23
SHA256

65f142b804eece9dc88fc0d8045abbce7e9e784f2019e482b49985d0e97ad02c
SHA512

86f20cc8422e487f7bea2a3d27ea60cdf77a6640a52ca111cd22b0c73fee1d36ea1f4f0eed737596f48023aa77bfb2d37aa3c27f63841e23998fc60c18fa58c8
SSDEEP

393216:kGooADpGPS1xVDu27qSywD+E8YiWhbI/WHBnPcwZvXd:aftG61PiYJrbG01cwFXd

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
static1/unpack001/funnneh/modest-menu.exe	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/funnneh/modest-menu.exe

Files

funnneh.rar
.rar .ps1
funnneh/config.json
funnneh/modest-menu.exe
.exe windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Size: 914KB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 72KB - Virtual size: 170KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 23KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 1KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.idata
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 18.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 12.4MB - Virtual size: 12.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
funnneh/scripts/Readme.api
funnneh/scripts/demo.lua
funnneh/scripts/sirius.lua.example
funnneh/scripts/vehicle.lua
funnneh/scripts/weapon.lua
funnneh/themes.json
funnneh/vehicles.json