unpacked_Silent_Hax_Private_3[.]2_protected[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

unpacked_Silent_Hax_Private_3.2_protected.exe
Size

15.6MB
MD5

93b0ad201ee40aea76189c0f1c885eca
SHA1

321ca639e5688b9dedfb794f589debbbe53b4a2a
SHA256

b56752c6791279736e349026a27c5c30c4ea7cd1db2b0e3c715c22d256562c0c
SHA512

855f15fa6cec077b0131f5a5f16c7dd677dcc035897d268d1c03f87b466d57150248768da474e50891caffb060977f86a13b1bb32dcc87484cb6449f0fd2143e
SSDEEP

393216:+reSkPZLM3oEF6T6lo3oYWq2SV0bsCiTw/Ugd:+rp3oqlo3oYWZ7bsCiT+U2

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpacked_Silent_Hax_Private_3.2_protected.exe

Files

unpacked_Silent_Hax_Private_3.2_protected.exe
.exe windows:6 windows x64 arch:x64

0d798981a185b87eff14cefa1bf5c80d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

CreateServiceA
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
GetTokenInformation
GetLengthSid
ConvertSidToStringSidW
OpenProcessToken
IsValidSid
CopySid
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptSignHashW
CryptEnumProvidersW
OpenServiceA
StartServiceA
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
RegOpenKeyExW
CloseServiceHandle
OpenSCManagerA
DeleteService
ChangeServiceConfigA
ControlService

crypt32

CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertAddCertificateContextToStore
CertGetCRLContextProperty
CertDuplicateCertificateContext
CryptStringToBinaryA
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext

gdi32

DeleteObject
GetObjectW

imm32

ImmReleaseContext
ImmSetCompositionWindow
ImmGetContext

kernel32

FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetConsoleCtrlHandler
GetTimeZoneInformation
DeleteFileW
CreateProcessW
GetFileAttributesExW
GetCurrentDirectoryW
GetFullPathNameW
SetStdHandle
FindClose
FindFirstFileExW
FindNextFileW
ReadProcessMemory
ReadFile
WriteFile
PeekNamedPipe
CreateFileW
GetLastError
CloseHandle
GetCurrentProcessId
WaitNamedPipeW
lstrlenW
GetModuleFileNameW
MultiByteToWideChar
WideCharToMultiByte
ExitProcess
WriteProcessMemory
HeapFree
GetCurrentProcess
TerminateProcess
InitializeCriticalSectionEx
OpenProcess
HeapSize
CreateToolhelp32Snapshot
Sleep
Process32NextW
Process32FirstW
HeapReAlloc
HeapAlloc
VirtualProtectEx
DecodePointer
HeapDestroy
LocalFree
DeleteCriticalSection
GetProcessHeap
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
LoadLibraryA
IsValidCodePage
GetProcAddress
VerSetConditionMask
FreeLibrary
QueryPerformanceCounter
SetConsoleTextAttribute
SetConsoleTitleA
GetStdHandle
WaitForMultipleObjects
GetCurrentDirectoryA
CreateFileA
DeleteFileA
CreateThread
GetConsoleWindow
SetConsoleOutputCP
VirtualAllocEx
VirtualFreeEx
VirtualQueryEx
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObject
FreeConsole
GetExitCodeProcess
SetLastError
FormatMessageA
GetTickCount
SleepEx
GetSystemDirectoryA
GetModuleHandleA
VerifyVersionInfoA
WaitForSingleObjectEx
ExpandEnvironmentStringsA
GetFileType
GetFileSizeEx
RtlCaptureContext
GetCPInfo
CompareStringEx
GetStringTypeW
LCMapStringEx
GetLocaleInfoEx
EncodePointer
GetModuleHandleW
GetSystemTimeAsFileTime
GetCurrentThreadId
SleepConditionVariableSRW
WakeAllConditionVariable
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetEndOfFile
GetEnvironmentVariableW
SetConsoleMode
ReadConsoleA
FormatMessageW
SwitchToFiber
DeleteFiber
FlushFileBuffers
CreateFiber
LoadLibraryW
ConvertFiberToThread
ConvertThreadToFiber
FindFirstFileW
GetSystemTime
SystemTimeToFileTime
RtlLookupFunctionEntry
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetConsoleOutputCP
ReadConsoleW
GetConsoleMode
GetCommandLineW
GetCommandLineA
SetFilePointerEx
InitializeSListHead
IsDebuggerPresent
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetFileInformationByHandle
GetDriveTypeW
VirtualQuery
GetStartupInfoW
OutputDebugStringW
RaiseException
RtlUnwindEx
VirtualProtect
VirtualAlloc
GetSystemInfo
FreeLibraryAndExitThread
ExitThread
WriteConsoleW
GetModuleHandleExW
LoadLibraryExW
TlsFree
TlsSetValue
InterlockedPushEntrySList
RtlPcToFileHeader
InitializeCriticalSectionAndSpinCount
RtlVirtualUnwind
RtlUnwind
QueryPerformanceFrequency
TlsGetValue
TlsAlloc
UnhandledExceptionFilter

rpcrt4

RpcStringFreeA
UuidToStringA
UuidCreate

shell32

ShellExecuteA
ShellExecuteExA
ShellExecuteW

shlwapi

IStream_Read
IStream_Reset
IStream_Size

user32

MessageBoxW
GetSystemMetrics
GetClassNameA
DispatchMessageW
PeekMessageW
EnumWindows
TranslateMessage
SetForegroundWindow
IsIconic
GetWindowTextW
GetKeyState
ScreenToClient
GetCapture
ClientToScreen
IsChild
GetForegroundWindow
GetWindowLongW
SetCursor
GetClientRect
keybd_event
ReleaseCapture
GetCursorPos
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
SetWindowDisplayAffinity
MessageBoxA
DefWindowProcW
FindWindowExW
GetWindowRect
RegisterClassExW
ShowWindow
MoveWindow
CreateWindowExA
BringWindowToTop
LoadIconW
FindWindowW
LoadCursorW
SetWindowLongW
UpdateWindow
GetAsyncKeyState
SetCursorPos
SendInput
GetProcessWindowStation
GetUserObjectInformationW
SetCapture

userenv

UnloadUserProfile

wldap32

ldap_search_sA
ldap_msgfree
ldap_err2stringA
ldap_first_entry
ldap_next_entry
ldap_simple_bind_sA
ldap_get_values_lenA
ldap_value_freeW
ldap_get_dnA
ldap_memfreeA
ber_free
ldap_bind_sA
ldap_first_attributeA
ldap_next_attributeA
ldap_unbind_s
ldap_initA
ldap_set_optionA

ws2_32

closesocket
recv
send
socket
htonl
WSACleanup
ioctlsocket
getaddrinfo
FreeAddrInfoW
htonl
recvfrom
sendto
gethostname
WSAStartup
WSAIoctl
setsockopt
accept
htons
htons
getsockopt
getsockname
getpeername
getnameinfo
connect
bind
WSASetLastError
select
__WSAFDIsSet
shutdown
inet_pton
listen
WSAGetLastError

bcrypt

BCryptGenRandom

d3d9

Direct3DCreate9

d3dx9_43

D3DXCreateTextureFromFileInMemory
D3DXCreateFontW

dwmapi

DwmExtendFrameIntoClientArea

gdiplus

GdipCloneImage
GdiplusShutdown
GdipAlloc
GdiplusStartup
GdipGetImageEncoders
GdipCreateBitmapFromScan0
GdipSaveImageToStream
GdipGetImageEncodersSize
GdipFree
GdipDisposeImage
GdipCreateBitmapFromHBITMAP

ole32

CoCreateInstance
CoUninitialize
CreateStreamOnHGlobal
CoInitialize

Sections

.text
Size: 3.6MB - Virtual size: 3.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 403KB - Virtual size: 668KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 159KB - Virtual size: 160KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 265KB - Virtual size: 268KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 34KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.imports
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 265KB - Virtual size: 268KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: 6.1MB - Virtual size: 6.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_MEM_READ

.SCY
Size: 10KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

0d798981a185b87eff14cefa1bf5c80d

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

crypt32

gdi32

imm32

kernel32

rpcrt4

shell32

shlwapi

user32

userenv

wldap32

ws2_32

bcrypt

d3d9

d3dx9_43

dwmapi

gdiplus

ole32

Sections

.text Size: 3.6MB - Virtual size: 3.6MB

Size: 1.4MB - Virtual size: 1.4MB

Size: 403KB - Virtual size: 668KB

Size: 159KB - Virtual size: 160KB

Size: 512B - Virtual size: 4KB

Size: 265KB - Virtual size: 268KB

Size: 34KB - Virtual size: 36KB

.imports Size: 1KB - Virtual size: 4KB

.tls Size: 512B - Virtual size: 4KB

.rsrc Size: 265KB - Virtual size: 268KB

.themida Size: 6.1MB - Virtual size: 6.1MB

.boot Size: 3.5MB - Virtual size: 3.5MB

.reloc Size: 512B - Virtual size: 4KB

.SCY Size: 10KB - Virtual size: 12KB

.text
Size: 3.6MB - Virtual size: 3.6MB

.imports
Size: 1KB - Virtual size: 4KB

.tls
Size: 512B - Virtual size: 4KB

.rsrc
Size: 265KB - Virtual size: 268KB

.themida
Size: 6.1MB - Virtual size: 6.1MB

.boot
Size: 3.5MB - Virtual size: 3.5MB

.reloc
Size: 512B - Virtual size: 4KB

.SCY
Size: 10KB - Virtual size: 12KB