990824b28b1db8f0e38bec6aebeaf1b2[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
990824b28b1db8f0e38bec6aebeaf1b2.bin
Size 5.1MB
Sample230924-cfcnpsde45
SHA256 1b9b20bf3cb028faa65a0a93602711ac4402ddf4c22b3708bd9e1246b65f6cd8
MD5 687061b47bf902e8c2850ef395d55e74
SHA1 ccaa4c235aeea55d3d6763d3f016a5b1488ddded
SHA512 9be16ac460787a27e5f0c53fd30cf7bb76c90f5b918370019e3754cec33519b2f91f871c7ee5743b00dbab175794292eb6c1cfd66f98d7f269b29c4383bd550a
SSDEEP 98304:yXDYFEr/5s7NGfpIAk0+e7Ze2zhEIpJrNV8xzB:qVhs7NgpIAkzeIYEIpAB
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
static1/unpack001/f45a8e04076925bd0d3990adaa82182945dad0c72d35873a108eb2cdefe29063.exe	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/f45a8e04076925bd0d3990adaa82182945dad0c72d35873a108eb2cdefe29063.exe

File Explorer

990824b28b1db8f0e38bec6aebeaf1b2.bin

.zip 5.1MB
f45a8e04076925bd0d3990adaa82182945dad0c72d35873a108eb2cdefe29063.exe

.exe 5.3MB

990824b28b1db8f0e38bec6aebeaf1b2.bin

SHA256 1b9b20bf3cb028faa65a0a93602711ac4402ddf4c22b3708bd9e1246b65f6cd8
MD5 687061b47bf902e8c2850ef395d55e74
SHA1 ccaa4c235aeea55d3d6763d3f016a5b1488ddded
SHA512 9be16ac460787a27e5f0c53fd30cf7bb76c90f5b918370019e3754cec33519b2f91f871c7ee5743b00dbab175794292eb6c1cfd66f98d7f269b29c4383bd550a
SSDEEP 98304:yXDYFEr/5s7NGfpIAk0+e7Ze2zhEIpJrNV8xzB:qVhs7NgpIAkzeIYEIpAB
MD5 SHA1 SHA512 SSDEEP

Password

infected

f45a8e04076925bd0d3990adaa82182945dad0c72d35873a108eb2cdefe29063.exe

IMPHASH 9e7ea608eaf52745b533b7e0cdbcbfde
SHA256 f45a8e04076925bd0d3990adaa82182945dad0c72d35873a108eb2cdefe29063
MD5 990824b28b1db8f0e38bec6aebeaf1b2
SHA1 75b2904f3481e5468e3076b842ff529b23e2d20b
SHA512 8a8637b4c50c9f92d42a4bae02dbe8e19d7867d91a542b95916d8de88eaf1dba5e7ede0b82934d6015e90d6b355a0193bfe6a941ffbb72ba97f9ee7e59c172f8
SSDEEP 98304:bz+UuR7m7n5+OPAZU+leHfQkjA1JAE5lPKn4m/V38fque1VIL:h8yn5+vZ6ALKnjyfRUI
MD5 SHA1 SHA512 SSDEEP

windows x86

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

6280131

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

Size

Virtual Size

223KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.zip0

Size

Virtual Size

237KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.themida

Size

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.zip1

Size

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.zip2

Size

512B

Virtual Size

444B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.zip3

Size

5.2MB

Virtual Size

5.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

81KB

Virtual Size

237KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

990824b28b1db8f0e38bec6aebeaf1b2.bin

f45a8e04076925bd0d3990adaa82182945dad0c72d35873a108eb2cdefe29063.exe

kernel32

ole32

oleaut32