privateloader | 6060-455-0x00007FF736860000-0x00007FF73769A000-memory[.]dmp

Sharing

Copy URL Twitter E-mail

General

Target

6060-455-0x00007FF736860000-0x00007FF73769A000-memory.dmp
Size

14.2MB
MD5

ad00059b11dc753544e0edd8857d91f6
SHA1

1303b4e04c526a410d46d050bfa698457dba88d5
SHA256

8cabef81cd07c5c772fd68f5af2bffb80fd950c2db5f543a99497c2dfec49c92
SHA512

d84d914d0f8065e0430699181a5471349180ca7da67af16231ed84ec5bce5c7bdfff71b9cd235fbdb5039c15ec964eab0aeba6c91fc7c7f2dfaa41227b5f4d90
SSDEEP

196608:EOaZEN5G90B8n07RSask+BPE3ACFNXgdxFoHqgMru6rqAcm+5ZMwxk:lZfr7RSal+BPE3idoAuaq595ZMR

Score

10^/10

themida privateloader

Malware Config

Signatures

Privateloader family
privateloader

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6060-455-0x00007FF736860000-0x00007FF73769A000-memory.dmp

Files

6060-455-0x00007FF736860000-0x00007FF73769A000-memory.dmp
.exe windows:6 windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Size: - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: - Virtual size: 240KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp*0
Size: - Virtual size: 182KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.themida
Size: - Virtual size: 3.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp*1
Size: - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp*2
Size: 1024B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp*3
Size: 5.4MB - Virtual size: 5.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 200B

IMAGE_SCN_MEM_READ

.rsrc
Size: 104KB - Virtual size: 182KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

Size: - Virtual size: 3.1MB

Size: - Virtual size: 240KB

Size: - Virtual size: 73KB

Size: - Virtual size: 85KB

Size: - Virtual size: 252B

.vmp*0 Size: - Virtual size: 182KB

Size: - Virtual size: 9KB

.idata Size: - Virtual size: 4KB

.tls Size: - Virtual size: 4KB

.themida Size: - Virtual size: 3.7MB

.vmp*1 Size: - Virtual size: 1.3MB

.vmp*2 Size: 1024B - Virtual size: 944B

.vmp*3 Size: 5.4MB - Virtual size: 5.4MB

.reloc Size: 512B - Virtual size: 200B

.rsrc Size: 104KB - Virtual size: 182KB

.vmp*0
Size: - Virtual size: 182KB

.idata
Size: - Virtual size: 4KB

.tls
Size: - Virtual size: 4KB

.themida
Size: - Virtual size: 3.7MB

.vmp*1
Size: - Virtual size: 1.3MB

.vmp*2
Size: 1024B - Virtual size: 944B

.vmp*3
Size: 5.4MB - Virtual size: 5.4MB

.reloc
Size: 512B - Virtual size: 200B

.rsrc
Size: 104KB - Virtual size: 182KB