2251c9b92ed1fb103f4574340c7d5ad6fc6de6758145d92bc605f039f1923b87[.]exe[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

2251c9b92ed1fb103f4574340c7d5ad6fc6de6758145d92bc605f039f1923b87.exe.zip
Size

5.1MB
MD5

2c778ace870f4c224e049376583817db
SHA1

82ed38a07c14fd2bafc5632ae9e27875852f7d5e
SHA256

c444cae4f6abfca29bfb624a9784fa0f2b608adc90379c869d39ed66b3eb165f
SHA512

c73f044be86bdcbdb8fcd07fa7ba179befba703b208be136818d38a0530156d79cfdd82359b44e2d07b6f95c78ea10f82ddc9a560396efec86ae53710da81a9b
SSDEEP

98304:zvlnjHjKrPGgGJtgYTImHyXR3lxfwuKbyoLkjdHWjtIZA1xCoJH:zvFOGgjmSpobWoAjkWK1wol

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
static1/unpack001/2251c9b92ed1fb103f4574340c7d5ad6fc6de6758145d92bc605f039f1923b87.exe	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/2251c9b92ed1fb103f4574340c7d5ad6fc6de6758145d92bc605f039f1923b87.exe

Files

2251c9b92ed1fb103f4574340c7d5ad6fc6de6758145d92bc605f039f1923b87.exe.zip
.zip

Password: infected
2251c9b92ed1fb103f4574340c7d5ad6fc6de6758145d92bc605f039f1923b87.exe
.exe windows:6 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 2.0MB - Virtual size: 4.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 246KB - Virtual size: 752KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 24KB - Virtual size: 26.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 3KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 186KB - Virtual size: 400KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 155KB - Virtual size: 279KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.idata
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 400KB - Virtual size: 400KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 3.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 16B - Virtual size: 4KB

IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Headers

DLL Characteristics

File Characteristics

Sections

Size: 2.0MB - Virtual size: 4.7MB

Size: 246KB - Virtual size: 752KB

Size: 24KB - Virtual size: 26.2MB

Size: 3KB - Virtual size: 9KB

Size: 186KB - Virtual size: 400KB

Size: 155KB - Virtual size: 279KB

.idata Size: 1KB - Virtual size: 4KB

.tls Size: 512B - Virtual size: 4KB

.rsrc Size: 400KB - Virtual size: 400KB

.themida Size: - Virtual size: 3.9MB

.boot Size: 2.4MB - Virtual size: 2.4MB

.reloc Size: 16B - Virtual size: 4KB

.idata
Size: 1KB - Virtual size: 4KB

.tls
Size: 512B - Virtual size: 4KB

.rsrc
Size: 400KB - Virtual size: 400KB

.themida
Size: - Virtual size: 3.9MB

.boot
Size: 2.4MB - Virtual size: 2.4MB

.reloc
Size: 16B - Virtual size: 4KB