DiscordClient_protected1[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
DiscordClient_protected1.exe
Size 3.9MB
Sample240411-vmaf2abc4v
SHA256 74d21d44cbe608ad924046d1a210ff1296fef147a90474e76df69b6f6a3a3ab3
MD5 e424147d44da9c361371240460f70855
SHA1 d72d2366e00a44557992b0e6d9d95a0d5c92135e
SHA512 9b01cfb1df86d65a59c2d3009512b5dd4ae29bb3a9c4caf1ce4601d19deb05eacaa73bb883e23ddbdf298a4ed9389b837b07a43b797c3e36474bfb7ef8918074
SSDEEP 98304:8DXwmM5AAksLQ1jksaKZi5B4yAxbA+onKyiKKyE7LQhHz:awmM6A5LQ1jksjiQO8KKyE7LET
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
DiscordClient_protected1.exe

File Explorer

DiscordClient_protected1.exe

.exe 3.9MB

DiscordClient_protected1.exe

SHA256 74d21d44cbe608ad924046d1a210ff1296fef147a90474e76df69b6f6a3a3ab3
MD5 e424147d44da9c361371240460f70855
SHA1 d72d2366e00a44557992b0e6d9d95a0d5c92135e
SHA512 9b01cfb1df86d65a59c2d3009512b5dd4ae29bb3a9c4caf1ce4601d19deb05eacaa73bb883e23ddbdf298a4ed9389b837b07a43b797c3e36474bfb7ef8918074
SSDEEP 98304:8DXwmM5AAksLQ1jksaKZi5B4yAxbA+onKyiKKyE7LQhHz:awmM6A5LQ1jksjiQO8KKyE7LET
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7422040

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

626KB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

512B

Virtual Size

432B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.idata

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

Virtual Size

5.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

3.3MB

Virtual Size

3.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

DiscordClient_protected1.exe

generic