unpacked_AridekVM_FREE[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

unpacked_AridekVM_FREE.exe
Size

43.1MB
MD5

44e0c4c18556bf2c0b4aab5aefca7154
SHA1

ed7223273936bd59dc3ab5c99b115a678a86a59d
SHA256

e0859c0c648838690d03d8f000d66b678e2393456013b7d8e7bb761079b0cf0d
SHA512

da44d408baa44e4f33fc6e0e3f1eed8ac8cdd60933d23c0cbed026e301e0e8b0c5a88f08b033f856f2ef0f0bce5a3870b1a8bb956e10b79c946877960a227b67
SSDEEP

393216:mJaxAgHE3MTduCofJ3wKqlQ7pAU41MtPPH+5i5be3J0m44hVHnv2uFYu7:YL3MFofJgFC7uFQPPHYi5b6n44hbFB

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpacked_AridekVM_FREE.exe

Files

unpacked_AridekVM_FREE.exe
.exe windows:6 windows x64 arch:x64

7e5b0dca0f6226e628f65282f3859bda

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegOpenKeyExW
RegQueryValueExW
RegCloseKey
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegEnumKeyExW
RegEnumValueW
GetTokenInformation
OpenThreadToken
RevertToSelf
ImpersonateLoggedOnUser
EventWrite
EventRegister
EventEnabled

crypt32

CertFreeCertificateChainEngine
CertCloseStore
PFXImportCertStore
PFXExportCertStore
CryptFindOIDInfo
CryptQueryObject
CryptMsgGetParam
CryptMsgClose
CryptImportPublicKeyInfoEx2
CryptFormatObject
CryptDecodeObject
CertFreeCertificateContext
CertVerifyCertificateChainPolicy
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertAddCRLLinkToStore
CertControlStore
CertCreateCertificateChainEngine
CertDuplicateCertificateContext
CertFindCertificateInStore
CertFindExtension
CertFreeCertificateChain
CertGetCertificateChain
CertGetCRLContextProperty
CertGetIntendedKeyUsage
CertGetNameStringW
CertGetValidUsages
CertNameToStrW
CertOpenStore
CertSaveStore
CertSerializeCRLStoreElement
CertSetCRLContextProperty
CertVerifyTimeValidity

iphlpapi

GetNetworkParams
if_nametoindex
GetPerAdapterInfo
GetAdaptersAddresses

kernel32

TlsAlloc
TlsGetValue
EncodePointer
TlsFree
RtlUnwind
RaiseException
RtlPcToFileHeader
TlsSetValue
RtlUnwindEx
SetLastError
GetLastError
LocalFree
CancelIoEx
CloseHandle
FormatMessageW
GetTickCount64
K32EnumProcessModulesEx
IsWow64Process
GetExitCodeProcess
CreateProcessW
TerminateProcess
OpenProcess
K32EnumProcesses
K32GetModuleInformation
K32GetModuleBaseNameW
K32GetModuleFileNameExW
GetProcessId
DuplicateHandle
CreatePipe
GetCPInfoExW
GetCurrentProcess
MultiByteToWideChar
WideCharToMultiByte
GetStdHandle
GetConsoleCP
GetConsoleOutputCP
LoadLibraryExW
QueryPerformanceCounter
CloseThreadpoolIo
ExitProcess
GetCurrentProcessId
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
FileTimeToSystemTime
GetSystemTime
GetCalendarInfoEx
CompareStringOrdinal
CompareStringEx
FindNLSStringEx
GetLocaleInfoEx
ResolveLocaleName
LCIDToLocaleName
GetUserPreferredUILanguages
FindStringOrdinal
GetCurrentProcessorNumber
GetCurrentThread
WaitForSingleObject
Sleep
CreateThreadpoolWork
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
InitializeCriticalSection
InitOnceInitialize
DeleteCriticalSection
EnterCriticalSection
SleepConditionVariableCS
LeaveCriticalSection
WakeConditionVariable
WaitForMultipleObjectsEx
QueryPerformanceFrequency
GetFullPathNameW
GetLongPathNameW
GetCPInfo
LocalAlloc
GetProcAddress
RaiseFailFastException
CreateThreadpoolIo
StartThreadpoolIo
CancelThreadpoolIo
LocaleNameToLCID
LCMapStringEx
EnumTimeFormatsEx
EnumCalendarInfoExEx
CreateDirectoryW
CreateFileW
DeleteFileW
DeviceIoControl
ExpandEnvironmentStringsW
FindClose
FindFirstFileExW
FlushFileBuffers
FreeLibrary
GetCurrentDirectoryW
GetFileAttributesExW
GetFileInformationByHandleEx
GetFileType
GetOverlappedResult
GetSystemDirectoryW
GetTempFileNameW
QueryUnbiasedInterruptTime
ReadFile
SetFileInformationByHandle
SetFilePointerEx
SetThreadErrorMode
GetDynamicTimeZoneInformation
GetTimeZoneInformation
WriteFile
SetEvent
ResetEvent
CreateEventExW
GetEnvironmentVariableW
CreateThread
ResumeThread
GetThreadPriority
SetThreadPriority
FillConsoleOutputAttribute
FillConsoleOutputCharacterW
GetConsoleScreenBufferInfo
GetConsoleMode
ReadConsoleW
ReadConsoleInputW
SetConsoleCursorPosition
SetConsoleOutputCP
SetConsoleTextAttribute
SetConsoleTitleW
WriteConsoleW
FlushProcessWriteBuffers
GetCurrentThreadId
WaitForSingleObjectEx
RtlCaptureContext
RtlRestoreContext
AddVectoredExceptionHandler
FlsAlloc
FlsGetValue
FlsSetValue
CreateEventW
SwitchToThread
SuspendThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualProtect
VirtualFree
QueryInformationJobObject
GetModuleHandleW
GetModuleHandleExW
GetProcessAffinityMask
InitializeContext
GetEnabledXStateFeatures
SetXStateFeaturesMask
VirtualQuery
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
DebugBreak
SleepEx
GlobalMemoryStatusEx
GetSystemInfo
GetTickCount
GetLogicalProcessorInformation
GetLogicalProcessorInformationEx
GetLargePageMinimum
VirtualUnlock
GetWriteWatch
ResetWriteWatch
VirtualAllocExNuma
IsProcessInJob
GetNumaHighestNodeNumber
GetProcessGroupAffinity
K32GetProcessMemoryInfo
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
InitializeCriticalSectionAndSpinCount

secur32

GetUserNameExW

user32

LoadStringW

ws2_32

WSARecv
WSAConnect
WSASend
send
setsockopt
WSAEventSelect
WSAGetOverlappedResult
closesocket
GetNameInfoW
GetAddrInfoW
FreeAddrInfoW
WSASocketW
GetAddrInfoExW
WSAStartup
WSACleanup
FreeAddrInfoExW
select
WSAIoctl
accept
bind
getpeername
getsockname
getsockopt
ioctlsocket
listen
recv
shutdown

ucrtbase

calloc
_set_new_mode
_callnewh
malloc
free
_configthreadlocale
asin
atan
atan2
cbrt
ceil
acos
exp
floor
log
log10
pow
sin
tan
modf
acosf
asinf
atanf
atan2f
cbrtf
ceilf
cosf
expf
floorf
logf
powf
sinf
modff
log2
fma
acosh
asinh
atanh
cosh
sinh
tanh
log2f
fmaf
acoshf
asinhf
atanhf
coshf
sinhf
tanhf
log10f
tanf
nan
nanf
_dclass
_fdclass
fmod
fmodf
__setusermatherr
cos
abort
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_initterm
exit
_initterm_e
_crt_atexit
_Exit
__p___argc
__p___wargv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
terminate
_get_initial_wide_environment
_register_onexit_function
_initialize_onexit_table
__stdio_common_vsprintf_s
__stdio_common_vsscanf
__stdio_common_vfprintf
__p__commode
_set_fmode
__acrt_iob_func
strncpy_s
_stricmp
_wcsicmp
wcsncmp
strcmp
strcpy_s

bcrypt

BCryptCreateHash
BCryptExportKey
BCryptFinishHash
BCryptGetProperty
BCryptHashData
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
BCryptDestroyKey
BCryptGenRandom
BCryptDestroyHash

ncrypt

NCryptSetProperty
NCryptGetProperty
NCryptFreeObject
NCryptDeleteKey
NCryptOpenStorageProvider
NCryptOpenKey
NCryptImportKey

ole32

CoCreateGuid
CoGetApartmentType
CoTaskMemFree
CoUninitialize
CoWaitForMultipleHandles
CoTaskMemAlloc
CoInitializeEx

Exports

Exports

DotNetRuntimeDebugHeader

Sections

.text
Size: 798KB - Virtual size: 800KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 4.6MB - Virtual size: 4.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 8.2MB - Virtual size: 8.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 439KB - Virtual size: 560KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 411KB - Virtual size: 412KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 245KB - Virtual size: 248KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.edata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: 18.0MB - Virtual size: 18.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 10.4MB - Virtual size: 10.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_MEM_READ

.SCY
Size: 10KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

7e5b0dca0f6226e628f65282f3859bda

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

crypt32

iphlpapi

kernel32

secur32

user32

ws2_32

ucrtbase

bcrypt

ncrypt

ole32

Exports

Exports

Sections

.text Size: 798KB - Virtual size: 800KB

Size: 4.6MB - Virtual size: 4.6MB

Size: 8.2MB - Virtual size: 8.2MB

Size: 439KB - Virtual size: 560KB

Size: 411KB - Virtual size: 412KB

Size: 512B - Virtual size: 4KB

Size: 4KB - Virtual size: 8KB

Size: 245KB - Virtual size: 248KB

.edata Size: 512B - Virtual size: 4KB

.idata Size: 1KB - Virtual size: 4KB

.tls Size: 512B - Virtual size: 4KB

.rsrc Size: 4KB - Virtual size: 8KB

.themida Size: 18.0MB - Virtual size: 18.0MB

.boot Size: 10.4MB - Virtual size: 10.4MB

.reloc Size: 512B - Virtual size: 4KB

.SCY Size: 10KB - Virtual size: 12KB

.text
Size: 798KB - Virtual size: 800KB

.edata
Size: 512B - Virtual size: 4KB

.idata
Size: 1KB - Virtual size: 4KB

.tls
Size: 512B - Virtual size: 4KB

.rsrc
Size: 4KB - Virtual size: 8KB

.themida
Size: 18.0MB - Virtual size: 18.0MB

.boot
Size: 10.4MB - Virtual size: 10.4MB

.reloc
Size: 512B - Virtual size: 4KB

.SCY
Size: 10KB - Virtual size: 12KB