Astro Menu v4[.]0[.]2[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Astro Menu v4.0.2.zip
Size

4.8MB
MD5

0ebd12258be11ce4c448cda03129c76d
SHA1

5374fff148f3f0eedf042822eb94cea089c96ef3
SHA256

3f01f8f01af235ac9e1f15b7feb8107b648eae8c0b7e4b017f6a2fb510fd567b
SHA512

a7639811d9ec0b28502e103558a7b52bafe4a0caf3d9a1206fc5000136e70ca84f23d4e1bacd1863ac44cd042650f88a686312c745a2909a0f1a7c572e6753b9
SSDEEP

98304:ulVHws2GK6f9jF7JDD4ci6QMcZGHRWVUkJyMCLhKQl4BXkW:ufioP1DtWMc8RWunMCkA4pkW

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
static1/unpack001/Astro Menu v4.0.2/Launcher.exe	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Astro Menu v4.0.2/Launcher.exe

Files

Astro Menu v4.0.2.zip
.zip
Astro Menu v4.0.2/Launcher.exe
.exe windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.text
Size: 1.9MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 16KB - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.imports
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 114KB - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 7.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 4.1MB - Virtual size: 4.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.taggant
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ