ffccf1df9e560e259284b35348a3989f[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
ffccf1df9e560e259284b35348a3989f.bin
Size 3.2MB
Sample240622-eghbpawhqe
SHA256 cfaa05a8448cba50762c5749e6852644d0545d9cc0fa00b955a4fec22fc9bd8b
MD5 f351900cee0e7204936b0e57de8b0432
SHA1 faee9d805e7fc78ac208a485aedaafae56ed1bc6
SHA512 1de68a561c96f4b40fd060cd424fe6f527503057f4b43bf84df82c747cae6f2913a2a10231b19217aaea57ed2e8ed6a1f40ccfbbde0e37a2e9e0b08f56dff3f6
SSDEEP 98304:PNMFkZX8/VfI7PmbQwq8TGCufjHw6TZF9VmpP:PNY68dHbQwDGCSjXr9VmpP
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
static1/unpack001/e2de3f42bd8737b0b825370aa662cf700b88a05832e4c26a3c7d8a3579b03227.exe	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/e2de3f42bd8737b0b825370aa662cf700b88a05832e4c26a3c7d8a3579b03227.exe

File Explorer

ffccf1df9e560e259284b35348a3989f.bin

.zip 3.2MB
e2de3f42bd8737b0b825370aa662cf700b88a05832e4c26a3c7d8a3579b03227.exe

.exe 3.3MB

ffccf1df9e560e259284b35348a3989f.bin

SHA256 cfaa05a8448cba50762c5749e6852644d0545d9cc0fa00b955a4fec22fc9bd8b
MD5 f351900cee0e7204936b0e57de8b0432
SHA1 faee9d805e7fc78ac208a485aedaafae56ed1bc6
SHA512 1de68a561c96f4b40fd060cd424fe6f527503057f4b43bf84df82c747cae6f2913a2a10231b19217aaea57ed2e8ed6a1f40ccfbbde0e37a2e9e0b08f56dff3f6
SSDEEP 98304:PNMFkZX8/VfI7PmbQwq8TGCufjHw6TZF9VmpP:PNY68dHbQwDGCSjXr9VmpP
MD5 SHA1 SHA512 SSDEEP

Password

infected

e2de3f42bd8737b0b825370aa662cf700b88a05832e4c26a3c7d8a3579b03227.exe

SHA256 e2de3f42bd8737b0b825370aa662cf700b88a05832e4c26a3c7d8a3579b03227
MD5 ffccf1df9e560e259284b35348a3989f
SHA1 853ad3befc8423ebd10442fc1fd3d436b3656afa
SHA512 e6d700471a381cd17f14ba3de4bd333088154f5079caa06f150c19525ab9f2d97c3204542ebf24febd622478240330076af7159973b9f9e21b5ee1d6dc8eebfa
SSDEEP 49152:VjED/HAkn8SIKu4lB38c1uHHkZZorrS7C8ff3AY1/X0aME7FW3gElVcOQW:dQ4k8StuM3T1qHkDGOC8nwGEaMEYK0
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

5972056

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

Size

628KB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

66KB

Virtual Size

159KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

2KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

28KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.idata

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.themida

Size

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

16B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ffccf1df9e560e259284b35348a3989f.bin

e2de3f42bd8737b0b825370aa662cf700b88a05832e4c26a3c7d8a3579b03227.exe

generic