Leviosa_Spoofer[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Leviosa_Spoofer.exe
Size 3.5MB
Sample240530-nsdbjsgh34
SHA256 15deb483acb4ea3242c27c36e5f083348e25f7bfaa4a64eb2b0979915679ad90
MD5 496f947c498ae50f85f8892262ecb782
SHA1 115de5b06d39f0be23c04dbdf579d271b929c902
SHA512 ac8248b6a8458aa468c7b4617e21d3f167d717897888027e34215c0ebf5dfcf295ced6fa715c6cf77d0976ec8db4471b133f34574fd61fb08130c3c6a14119b8
SSDEEP 49152:x9oFQP3PMQ4PcQpU4fx7tE5H6aGxXN3khJtAhLsrwhxSJzoacwlDlDthWSTrgYK4:x9o6sQ4PcQUs7tMKkhQ8Jzoml7WS47s
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Leviosa_Spoofer.exe

File Explorer

Leviosa_Spoofer.exe

.exe 3.5MB

Leviosa_Spoofer.exe

SHA256 15deb483acb4ea3242c27c36e5f083348e25f7bfaa4a64eb2b0979915679ad90
MD5 496f947c498ae50f85f8892262ecb782
SHA1 115de5b06d39f0be23c04dbdf579d271b929c902
SHA512 ac8248b6a8458aa468c7b4617e21d3f167d717897888027e34215c0ebf5dfcf295ced6fa715c6cf77d0976ec8db4471b133f34574fd61fb08130c3c6a14119b8
SSDEEP 49152:x9oFQP3PMQ4PcQpU4fx7tE5H6aGxXN3khJtAhLsrwhxSJzoacwlDlDthWSTrgYK4:x9o6sQ4PcQUs7tMKkhQ8Jzoml7WS47s
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10018816

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

Size

18KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

5KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

326KB

Virtual Size

844KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

1KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

35KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

213B

Virtual Size

224B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.imports

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

35KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

Virtual Size

5.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.taggant

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Leviosa_Spoofer.exe

generic