privateloader | 4236-457-0x00007FF6274C0000-0x00007FF6282FA000-memory[.]dmp

Sharing

Copy URL

Twitter E-mail

General

Target

4236-457-0x00007FF6274C0000-0x00007FF6282FA000-memory.dmp
Size

14.2MB
MD5

60f85521a04de28d8adacbe1f0b8430c
SHA1

9b8f1cfa04a67cfd6484fb4e043ab356a08c6ddd
SHA256

c060c4296d8a8f0a807a817e73e139704f4a2fd3cbdad7693f1bf1dbd0e5d3cb
SHA512

f1a0aa232f1a6c7dea9e08031b1c60b991965aece0079102e576909fd5e2998352192921271bb4f7c6a996c904b5f4d1a9855f052ea99c4b6be88cdac093e1e6
SSDEEP

196608:oOaZEN5C9tB8n0CJ6aUsJBPE3ACFNXgdxFoHqgMru6rGAcm+9pMYVk:RZqrCJ6aZJBPE3idoAuaG599pMB

Score

10^/10

themida privateloader

Malware Config

Signatures

Privateloader family
privateloader

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4236-457-0x00007FF6274C0000-0x00007FF6282FA000-memory.dmp

Files

4236-457-0x00007FF6274C0000-0x00007FF6282FA000-memory.dmp
.exe windows:6 windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Size: - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: - Virtual size: 240KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp*0
Size: - Virtual size: 182KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.themida
Size: - Virtual size: 3.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp*1
Size: - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp*2
Size: 1024B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp*3
Size: 5.4MB - Virtual size: 5.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 200B

IMAGE_SCN_MEM_READ

.rsrc
Size: 104KB - Virtual size: 182KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

Size: - Virtual size: 3.1MB

Size: - Virtual size: 240KB

Size: - Virtual size: 73KB

Size: - Virtual size: 85KB

Size: - Virtual size: 252B

.vmp*0 Size: - Virtual size: 182KB

Size: - Virtual size: 9KB

.idata Size: - Virtual size: 4KB

.tls Size: - Virtual size: 4KB

.themida Size: - Virtual size: 3.7MB

.vmp*1 Size: - Virtual size: 1.3MB

.vmp*2 Size: 1024B - Virtual size: 944B

.vmp*3 Size: 5.4MB - Virtual size: 5.4MB

.reloc Size: 512B - Virtual size: 200B

.rsrc Size: 104KB - Virtual size: 182KB

.vmp*0
Size: - Virtual size: 182KB

.idata
Size: - Virtual size: 4KB

.tls
Size: - Virtual size: 4KB

.themida
Size: - Virtual size: 3.7MB

.vmp*1
Size: - Virtual size: 1.3MB

.vmp*2
Size: 1024B - Virtual size: 944B

.vmp*3
Size: 5.4MB - Virtual size: 5.4MB

.reloc
Size: 512B - Virtual size: 200B

.rsrc
Size: 104KB - Virtual size: 182KB