smartscreen_protected[.]exe14458798949[.]zip | Triage

Sharing

General

Target

smartscreen_protected.exe14458798949.zip
Size

2.9MB
MD5

e9c58d64a92832b536d090aea63498b1
SHA1

483feaec10e810124024e581f267f00c4e9b7318
SHA256

a19cc7a55753553c4fe8fdb426b6e5c6924f8824cba57ba3a0dece4ac788b64b
SHA512

6ccf29202f97215cf388670c750e003605a3258a3ac4c4c2c5fcb49a3ec14abb858eff5e1b77422040643952ef1199207edd56e1d6e37a112045dec1c7ac4d0e
SSDEEP

49152:AIH0ZhFvbq1gFbP7kMJFusJyr3huiOaBVy/ELksn4wiH7dxSejUZo8jRz:AIH0ZhxmOFbf7uJr3h5LyIYwiGeYhZ

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
static1/unpack001/c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0

Files

smartscreen_protected.exe14458798949.zip
.zip

Password: infected
c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0
.exe windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 149KB - Virtual size: 327KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 39KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 5KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 14KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 4.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 16B - Virtual size: 4KB

IMAGE_SCN_MEM_READ