ad7b4598918c9f75bcad2d3837abc47e[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
ad7b4598918c9f75bcad2d3837abc47e.bin
Size 3.3MB
Sample240622-dzrgmswarh
SHA256 d5523864ef70c0e5fb27c3a6e80ce422fc3786a6a1203fbccf1c04ba1b819d06
MD5 39e95dd0ac3b315d47ceef2f014f0389
SHA1 f3828dc33246adf966a23dd4bbf806fc319e70ab
SHA512 10140e5b12998701a469cff3118c1df351cbcef3bd4c0a564e3db0c5d53536bbaa168216ce9105363892adaa5eea6c6da9b2faa810c7a9935c477efb5252649f
SSDEEP 98304:ZVyhmpwtqxYxktZPhXHW7A+dC6qwWiqwiCpnIwU32R8yFLt3:ShmpEqcOPNMAXwWvwiCpe3U3
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
static1/unpack001/d0e3c511f4c02b9dd4130462ac716024ad29581a072a9095f40ac7c348c7ede6.exe	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/d0e3c511f4c02b9dd4130462ac716024ad29581a072a9095f40ac7c348c7ede6.exe

File Explorer

ad7b4598918c9f75bcad2d3837abc47e.bin

.zip 3.3MB
d0e3c511f4c02b9dd4130462ac716024ad29581a072a9095f40ac7c348c7ede6.exe

.exe 3.4MB

ad7b4598918c9f75bcad2d3837abc47e.bin

SHA256 d5523864ef70c0e5fb27c3a6e80ce422fc3786a6a1203fbccf1c04ba1b819d06
MD5 39e95dd0ac3b315d47ceef2f014f0389
SHA1 f3828dc33246adf966a23dd4bbf806fc319e70ab
SHA512 10140e5b12998701a469cff3118c1df351cbcef3bd4c0a564e3db0c5d53536bbaa168216ce9105363892adaa5eea6c6da9b2faa810c7a9935c477efb5252649f
SSDEEP 98304:ZVyhmpwtqxYxktZPhXHW7A+dC6qwWiqwiCpnIwU32R8yFLt3:ShmpEqcOPNMAXwWvwiCpe3U3
MD5 SHA1 SHA512 SSDEEP

Password

infected

d0e3c511f4c02b9dd4130462ac716024ad29581a072a9095f40ac7c348c7ede6.exe

SHA256 d0e3c511f4c02b9dd4130462ac716024ad29581a072a9095f40ac7c348c7ede6
MD5 ad7b4598918c9f75bcad2d3837abc47e
SHA1 c216e887a2559bc45f4b75d8f97e8d2450f16213
SHA512 6de0d861f74e9710a3953ae2196a42dde9bee708ddaf40ee294abeeadab097b2e3fc9de1a21aa146f747c821af16d92c4cab94537833bf1bbd7396b315d9be66
SSDEEP 49152:ustZbif3Y+7iIP/+luqThrrmOWEgersFUx3VDzjtwrbAzToGb+938BLgd4nOKUKj:3tkfH7Okq5yOjFF1iAz8M/OKmiGXq
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

5972056

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

Size

628KB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

66KB

Virtual Size

159KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

2KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

28KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.idata

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.themida

Size

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

16B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ad7b4598918c9f75bcad2d3837abc47e.bin

d0e3c511f4c02b9dd4130462ac716024ad29581a072a9095f40ac7c348c7ede6.exe

generic