privateloader | 4652-387-0x00007FF7A3CE0000-0x00007FF7A4B1A000-memory[.]dmp

Sharing

Copy URL

Twitter E-mail

General

Target

4652-387-0x00007FF7A3CE0000-0x00007FF7A4B1A000-memory.dmp
Size

14.2MB
MD5

609d9ae63c248fdb528a17382309cb0e
SHA1

2bc7638d734ee38b9d1ff69fc7a1a814541dbe84
SHA256

60d956d08b1fbb2b1606443b501dc437ff8e7311a7195e8611ac5a72601272f5
SHA512

0fff078c3ad1081f77e4553767b22ddfa2653bb5dddd7c81ed6401652523d51763817a97e25c329dd02e1d088c153bf4014f3a0068546737578bbe2efbb256d5
SSDEEP

196608:LOaZEN539lB8n0qZqa008BPE3ACFNXgdxFoHqgMru6r0Acm+1ZMotk:qZ1rqZqax8BPE3idoAua0591ZMB

Score

10^/10

themida privateloader

Malware Config

Signatures

Privateloader family
privateloader

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4652-387-0x00007FF7A3CE0000-0x00007FF7A4B1A000-memory.dmp

Files

4652-387-0x00007FF7A3CE0000-0x00007FF7A4B1A000-memory.dmp
.exe windows:6 windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Size: - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: - Virtual size: 240KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp*0
Size: - Virtual size: 182KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.themida
Size: - Virtual size: 3.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp*1
Size: - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp*2
Size: 1024B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp*3
Size: 5.4MB - Virtual size: 5.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 200B

IMAGE_SCN_MEM_READ

.rsrc
Size: 104KB - Virtual size: 182KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

Size: - Virtual size: 3.1MB

Size: - Virtual size: 240KB

Size: - Virtual size: 73KB

Size: - Virtual size: 85KB

Size: - Virtual size: 252B

.vmp*0 Size: - Virtual size: 182KB

Size: - Virtual size: 9KB

.idata Size: - Virtual size: 4KB

.tls Size: - Virtual size: 4KB

.themida Size: - Virtual size: 3.7MB

.vmp*1 Size: - Virtual size: 1.3MB

.vmp*2 Size: 1024B - Virtual size: 944B

.vmp*3 Size: 5.4MB - Virtual size: 5.4MB

.reloc Size: 512B - Virtual size: 200B

.rsrc Size: 104KB - Virtual size: 182KB

.vmp*0
Size: - Virtual size: 182KB

.idata
Size: - Virtual size: 4KB

.tls
Size: - Virtual size: 4KB

.themida
Size: - Virtual size: 3.7MB

.vmp*1
Size: - Virtual size: 1.3MB

.vmp*2
Size: 1024B - Virtual size: 944B

.vmp*3
Size: 5.4MB - Virtual size: 5.4MB

.reloc
Size: 512B - Virtual size: 200B

.rsrc
Size: 104KB - Virtual size: 182KB