privateloader | 5692-449-0x00007FF603080000-0x00007FF604011000-memory[.]dmp

Sharing

Copy URL

Twitter E-mail

General

Target

5692-449-0x00007FF603080000-0x00007FF604011000-memory.dmp
Size

15.6MB
MD5

4fa4f7e7659189b079e7cb84a14e8729
SHA1

bbffb751f57b15db402202ee8c1953b4c49e58d9
SHA256

b6ced32fbf89b8b13684257238706e107c52fc4d758c65f125ce84ea3cb433cc
SHA512

c4e4bd7403fd64f19e78b066191b8b3e08697d3f55cc53e55259fb2609a7be88974b1f5ccd89af1bf0c41dcfc3f467de9c0d3bfdac6339e952df5ceb982fe1a4
SSDEEP

196608:FOaZ3PHQgV6P6vs+K/M7BDdUbRHSXqzjYf+saZSVMqhmLoYnIsR0yQf:YKQggSs+KNDf4+bSVvmUY/rK

Score

10^/10

themida privateloader

Malware Config

Signatures

Privateloader family
privateloader

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5692-449-0x00007FF603080000-0x00007FF604011000-memory.dmp

Files

5692-449-0x00007FF603080000-0x00007FF604011000-memory.dmp
.exe windows:6 windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Size: - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: - Virtual size: 240KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.7-Zip0
Size: - Virtual size: 189KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.themida
Size: - Virtual size: 4.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.7-Zip1
Size: - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.7-Zip2
Size: 1024B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.7-Zip3
Size: 6.3MB - Virtual size: 6.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 148B

IMAGE_SCN_MEM_READ

.rsrc
Size: 111KB - Virtual size: 189KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

Size: - Virtual size: 3.1MB

Size: - Virtual size: 240KB

Size: - Virtual size: 73KB

Size: - Virtual size: 85KB

Size: - Virtual size: 252B

.7-Zip0 Size: - Virtual size: 189KB

Size: - Virtual size: 9KB

.idata Size: - Virtual size: 4KB

.tls Size: - Virtual size: 4KB

.themida Size: - Virtual size: 4.1MB

.7-Zip1 Size: - Virtual size: 1.3MB

.7-Zip2 Size: 1024B - Virtual size: 944B

.7-Zip3 Size: 6.3MB - Virtual size: 6.3MB

.reloc Size: 512B - Virtual size: 148B

.rsrc Size: 111KB - Virtual size: 189KB

.7-Zip0
Size: - Virtual size: 189KB

.idata
Size: - Virtual size: 4KB

.tls
Size: - Virtual size: 4KB

.themida
Size: - Virtual size: 4.1MB

.7-Zip1
Size: - Virtual size: 1.3MB

.7-Zip2
Size: 1024B - Virtual size: 944B

.7-Zip3
Size: 6.3MB - Virtual size: 6.3MB

.reloc
Size: 512B - Virtual size: 148B

.rsrc
Size: 111KB - Virtual size: 189KB