privateloader | 1192-513-0x00007FF660710000-0x00007FF66154A000-memory[.]dmp

Sharing

Copy URL

Twitter E-mail

General

Target

1192-513-0x00007FF660710000-0x00007FF66154A000-memory.dmp
Size

14.2MB
MD5

46f4d30d61a3354e386dad5b19fb303d
SHA1

a911b140097a13746e6c278ce79089945435102b
SHA256

7c02dd58e6b6999f12e409b03e9c35f3e0fdc4475695484feb23d1c524e6a471
SHA512

8a5c039d8b0d84ba117b32f91007543e4c5f2d0e5c945f954b29791d73567231dec2b9e95dc681c2710e83401d31e1cf7ad5e9ed429a4a1db394ad60d45ec682
SSDEEP

196608:oOaZEN529XB8n0ocEawdRBPE3ACFNXgdxFoHqgMru6rqAcm+BxM/ck:RZArocEaERBPE3idoAuaq59BxMR

Score

10^/10

themida privateloader

Malware Config

Signatures

Privateloader family
privateloader

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1192-513-0x00007FF660710000-0x00007FF66154A000-memory.dmp

Files

1192-513-0x00007FF660710000-0x00007FF66154A000-memory.dmp
.exe windows:6 windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Size: - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: - Virtual size: 240KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp*0
Size: - Virtual size: 182KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.themida
Size: - Virtual size: 3.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp*1
Size: - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp*2
Size: 1024B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp*3
Size: 5.4MB - Virtual size: 5.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 200B

IMAGE_SCN_MEM_READ

.rsrc
Size: 104KB - Virtual size: 182KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

Size: - Virtual size: 3.1MB

Size: - Virtual size: 240KB

Size: - Virtual size: 73KB

Size: - Virtual size: 85KB

Size: - Virtual size: 252B

.vmp*0 Size: - Virtual size: 182KB

Size: - Virtual size: 9KB

.idata Size: - Virtual size: 4KB

.tls Size: - Virtual size: 4KB

.themida Size: - Virtual size: 3.7MB

.vmp*1 Size: - Virtual size: 1.3MB

.vmp*2 Size: 1024B - Virtual size: 944B

.vmp*3 Size: 5.4MB - Virtual size: 5.4MB

.reloc Size: 512B - Virtual size: 200B

.rsrc Size: 104KB - Virtual size: 182KB

.vmp*0
Size: - Virtual size: 182KB

.idata
Size: - Virtual size: 4KB

.tls
Size: - Virtual size: 4KB

.themida
Size: - Virtual size: 3.7MB

.vmp*1
Size: - Virtual size: 1.3MB

.vmp*2
Size: 1024B - Virtual size: 944B

.vmp*3
Size: 5.4MB - Virtual size: 5.4MB

.reloc
Size: 512B - Virtual size: 200B

.rsrc
Size: 104KB - Virtual size: 182KB