MegaHackInstaller[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
MegaHackInstaller.exe
Size 4.2MB
Sample241109-3ypdbsxpfn
SHA256 e840c1a894e7b96d401845f37f634204dccf23fb23f73e847131e8467cb62524
MD5 df36e1cd968c7336fe4f29094e4099f9
SHA1 2034e5f5d130dbf71c7e6ac82f8dbf808cfbd5c4
SHA512 47778a6a1aa96ac8a2b5acb1208562df8b2e9e053d21cae9a8077b5d072d3661449c0e33444b4b19c4c1774a89663077df03668cef45108b5a92ae508fb02f37
SSDEEP 98304:Qj2MjWxUAAWc0fnpTBTgY4EaIsSYK39B9Biih/nIGm9:Q6MEkWdBTgYzXsbYB9fnxk
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
MegaHackInstaller.exe

File Explorer

MegaHackInstaller.exe

.exe 4.2MB

MegaHackInstaller.exe

SHA256 e840c1a894e7b96d401845f37f634204dccf23fb23f73e847131e8467cb62524
MD5 df36e1cd968c7336fe4f29094e4099f9
SHA1 2034e5f5d130dbf71c7e6ac82f8dbf808cfbd5c4
SHA512 47778a6a1aa96ac8a2b5acb1208562df8b2e9e053d21cae9a8077b5d072d3661449c0e33444b4b19c4c1774a89663077df03668cef45108b5a92ae508fb02f37
SSDEEP 98304:Qj2MjWxUAAWc0fnpTBTgY4EaIsSYK39B9Biih/nIGm9:Q6MEkWdBTgYzXsbYB9fnxk
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8196272

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

Size

98KB

Virtual Size

204KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

261KB

Virtual Size

538KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

1024B

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

2KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

11KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.idata

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

Virtual Size

7.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

3.8MB

Virtual Size

3.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

16B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ

generic

count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=12, id=260, version=31823,

count=5, id=259, version=31823,

count=33, id=261, version=31823,

count=4, id=257, version=31823,

count=1, id=262, version=29395,

count=1, id=261, productName=VS2019 v16.6.2 build 28806, version=28806,

count=8, id=257, productName=VS2019 v16.6.2 build 28806, version=28806,

count=7, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,

count=2, id=259, productName=VS2019 v16.9.2 build 29913, version=29913,

count=70, id=264, version=31933,

count=2, id=257, version=27034,

count=13, id=257, version=29395,

count=728, id=1, productName=Unmarked objects,

count=7, id=261, version=31933,

count=1, id=255, version=31933,

count=1, id=151,

count=1, id=258, version=31933,