avaddon | cc7852dc77152c57aa51e7b7dc34e09e086bba8845334d28d652b07adbc651bb[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
cc7852dc77152c57aa51e7b7dc34e09e086bba8845334d28d652b07adbc651bb.zip
Size 2.3MB
Sample240402-qeskesbb28
SHA256 13a2c3db7c67bbfbdbb77dd6df6c622bfd9f24a4ed1bfb20792a8319f250789d
MD5 dac04391acd14517c0973edef61b1e42
SHA1 a7221e5eac3a075b55ec0f8b601723c94d272d67
SHA512 42df28496dc571d034d00b024f77c1e005b5f7bd1875e4435e1d0a28bc55c1b614bb1c1dd23341cacca4ff0c85227345dd626e0ffb2646147a3a021559870559
SSDEEP 49152:/lsKU/mJBmM9Zbc64vzTgrBucpjMyARcuyHawcj4UAExGT5Kq3Y3dD8eB9xLcq:dsKU/2BmMnI64vg0cpjZHHajsUBkNU3D
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

themida avaddon

Malware Config

Signatures

Avaddon family
avaddon

Avaddon payload 1 IoCs

resource	yara_rule
static1/unpack001/cc7852dc77152c57aa51e7b7dc34e09e086bba8845334d28d652b07adbc651bb.exe	family_avaddon

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
static1/unpack001/cc7852dc77152c57aa51e7b7dc34e09e086bba8845334d28d652b07adbc651bb.exe	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/cc7852dc77152c57aa51e7b7dc34e09e086bba8845334d28d652b07adbc651bb.exe

File Explorer

cc7852dc77152c57aa51e7b7dc34e09e086bba8845334d28d652b07adbc651bb.zip

.zip 2.3MB
cc7852dc77152c57aa51e7b7dc34e09e086bba8845334d28d652b07adbc651bb.exe

.exe 4.4MB

cc7852dc77152c57aa51e7b7dc34e09e086bba8845334d28d652b07adbc651bb.zip

SHA256 13a2c3db7c67bbfbdbb77dd6df6c622bfd9f24a4ed1bfb20792a8319f250789d
MD5 dac04391acd14517c0973edef61b1e42
SHA1 a7221e5eac3a075b55ec0f8b601723c94d272d67
SHA512 42df28496dc571d034d00b024f77c1e005b5f7bd1875e4435e1d0a28bc55c1b614bb1c1dd23341cacca4ff0c85227345dd626e0ffb2646147a3a021559870559
SSDEEP 49152:/lsKU/mJBmM9Zbc64vzTgrBucpjMyARcuyHawcj4UAExGT5Kq3Y3dD8eB9xLcq:dsKU/2BmMnI64vg0cpjZHHajsUBkNU3D
MD5 SHA1 SHA512 SSDEEP

Password

infected

cc7852dc77152c57aa51e7b7dc34e09e086bba8845334d28d652b07adbc651bb.exe

SHA256 cc7852dc77152c57aa51e7b7dc34e09e086bba8845334d28d652b07adbc651bb
MD5 de224a9b8280cac9fb93da85dae08b85
SHA1 798b84d0ed6d149c4defc575216e82fdb00d7864
SHA512 de78f5fffc679bee9640828c3eac3d3689901dba27f4c79d54739412242a79f07b6db27dc8e3842a3e106044e38f87aa0f4b1a4412f72b5e7ceaf4fa6291e814
SSDEEP 98304:bw3OKBzMFxybbbbpNGWeEi4DtrRKm40djW1mGaHV:bw3y6bbbbpNYwDdjW1zqV
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Avaddon payload
Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

1560848

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

616KB

Virtual Size

616KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

427KB

Virtual Size

427KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

38KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

44KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.idata

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.themida

Size

3.7MB

Virtual Size

3.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

16B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

cc7852dc77152c57aa51e7b7dc34e09e086bba8845334d28d652b07adbc651bb.zip

cc7852dc77152c57aa51e7b7dc34e09e086bba8845334d28d652b07adbc651bb.exe

generic