SecuriteInfo[.]com[.]Trojan[.]GenericKD[.]72111020[.]32653[.]16504[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

SecuriteInfo.com.Trojan.GenericKD.72111020.32653.16504.exe
Size

4.9MB
MD5

86a82d95a15b8b6e4aa70d01ab585367
SHA1

4cf7e968f060576953dc76475071a64ec26dd83d
SHA256

f25ec06833cd9a9569e2459ab9e079f68f4b18849d56576db4241f34492c14ae
SHA512

6cf75204d0959d818e81a58f0545e83e4a40826bd11080cc41a280b036373360e6031fbe5f4e0b73e7bb1375eb1152ffe0363e710e8856ead01d178b42459e7a
SSDEEP

98304:x2puP6FNXRH0jYjaviY3ZRXpbAPtfd2EwXHup:uuiXRHgYjavikYtUEqO

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SecuriteInfo.com.Trojan.GenericKD.72111020.32653.16504.exe

Files

SecuriteInfo.com.Trojan.GenericKD.72111020.32653.16504.exe
.exe windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Size: 87KB - Virtual size: 224KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 26KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 112KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 7.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 4.7MB - Virtual size: 4.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ