avaddon | HEUR-Trojan-Ransom[.]Win32[.]Avaddon[.]vho-7b7c16367746efe7583ae46235b2f062ce44602dda990c9a11a730d619b8d365[.]7z

Sharing

Copy URL Twitter E-mail

General

Target
HEUR-Trojan-Ransom.Win32.Avaddon.vho-7b7c16367746efe7583ae46235b2f062ce44602dda990c9a11a730d619b8d365.7z
Size 2.2MB
Sample250402-tmvxassmy5
SHA256 1640dbb1202916848fa226c543ee4abf6a3c24f357548f4cfcb41319b153803e
MD5 02ab46ad0f72ebf04bfc987b1c6cfd93
SHA1 1d319b9ecda6f4860bca276e00ed33c1e572f151
SHA512 0949a55aca5d9d39061b219eb8e863e7c99abdc822747072d8b55d1ad9a3570f69419bde0bb957d414af1ff462fc6853b78a684f8fe2aa4eb142ffc27b5f5cbb
SSDEEP 49152:VS4oWqzZEwotFlMO+feUOqW2MjUp7d6wCuxfQzT:lBqzZEwoXli2z296
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

themida avaddon

Malware Config

Signatures

Avaddon family
avaddon

Avaddon payload 1 IoCs

resource	yara_rule
static1/unpack001/HEUR-Trojan-Ransom.Win32.Avaddon.vho-7b7c16367746efe7583ae46235b2f062ce44602dda990c9a11a730d619b8d365.exe	family_avaddon

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
static1/unpack001/HEUR-Trojan-Ransom.Win32.Avaddon.vho-7b7c16367746efe7583ae46235b2f062ce44602dda990c9a11a730d619b8d365.exe	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/HEUR-Trojan-Ransom.Win32.Avaddon.vho-7b7c16367746efe7583ae46235b2f062ce44602dda990c9a11a730d619b8d365.exe

File Explorer

HEUR-Trojan-Ransom.Win32.Avaddon.vho-7b7c16367746efe7583ae46235b2f062ce44602dda990c9a11a730d619b8d365.7z

.7z 2.2MB
HEUR-Trojan-Ransom.Win32.Avaddon.vho-7b7c16367746efe7583ae46235b2f062ce44602dda990c9a11a730d619b8d365.exe

.exe 4.8MB

HEUR-Trojan-Ransom.Win32.Avaddon.vho-7b7c16367746efe7583ae46235b2f062ce44602dda990c9a11a730d619b8d365.7z

SHA256 1640dbb1202916848fa226c543ee4abf6a3c24f357548f4cfcb41319b153803e
MD5 02ab46ad0f72ebf04bfc987b1c6cfd93
SHA1 1d319b9ecda6f4860bca276e00ed33c1e572f151
SHA512 0949a55aca5d9d39061b219eb8e863e7c99abdc822747072d8b55d1ad9a3570f69419bde0bb957d414af1ff462fc6853b78a684f8fe2aa4eb142ffc27b5f5cbb
SSDEEP 49152:VS4oWqzZEwotFlMO+feUOqW2MjUp7d6wCuxfQzT:lBqzZEwoXli2z296
MD5 SHA1 SHA512 SSDEEP

Password

infected

HEUR-Trojan-Ransom.Win32.Avaddon.vho-7b7c16367746efe7583ae46235b2f062ce44602dda990c9a11a730d619b8d365.exe

SHA256 7b7c16367746efe7583ae46235b2f062ce44602dda990c9a11a730d619b8d365
MD5 6ff1ca648505fe8bea6b4a26616b9722
SHA1 7020b4d9e700b697d507a61bffea12c9475a23d2
SHA512 e65d67e22807e1a539997bd763fc6063226fce207c57b3b0316ef7640471f460016fa5f58feb006ff96dd7a2cf5bcff7c17f0af763e8518431fe13ce6d8c9db2
SSDEEP 98304:zDAjjvoF+Cp+/bbbbp7FO1gTL9M5gmoZHOoOVsHalI:zuvAObbbbp78+VwzV0alI
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Avaddon payload
Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

2392484

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

614KB

Virtual Size

614KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

427KB

Virtual Size

426KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

37KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

44KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.idata

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.themida

Size

3.7MB

Virtual Size

3.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

16B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

HEUR-Trojan-Ransom.Win32.Avaddon.vho-7b7c16367746efe7583ae46235b2f062ce44602dda990c9a11a730d619b8d365.7z

HEUR-Trojan-Ransom.Win32.Avaddon.vho-7b7c16367746efe7583ae46235b2f062ce44602dda990c9a11a730d619b8d365.exe

generic