KamiLib_Release[.]Free[.]2024_protected[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

KamiLib_Release.Free.2024_protected.exe
Size

101.7MB
MD5

c42e766ee223f804c249154ecbee1105
SHA1

14d7fc920c36b6ea63d9a9397e8f45488792375e
SHA256

b870ac1af9eb6ca70af767b7d052b166ba996d77588c61bd2a5054a4743b6f1b
SHA512

403d8bbe0c2365d078b4ab6c5a5204e530e711011005dc329c18e55dafa06302d7b18585784648f1175d2e3b5dd51144a53d0898646cf0be3d7f02c1099566e4
SSDEEP

1572864:pQGyzUMig+9e6F/qV7AHnCnU7pMChrmGLsw48iqIIsO8BYX/eXRNyIZLokO2ANWH:OGyzzW5KU6xGLsw4FqOSPmNyIkNqx

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
KamiLib_Release.Free.2024_protected.exe

Files

KamiLib_Release.Free.2024_protected.exe
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Size: 95.9MB - Virtual size: 95.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 37KB - Virtual size: 171KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 172KB - Virtual size: 172KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 9.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 5.6MB - Virtual size: 5.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ