unpacked_fcam_pro[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
unpacked_fcam_pro.exe
Size 23.1MB
Sample260416-rtjrhaa14l
SHA256 08f80c7a347a5eb8ffd9743001b990b40598aa336f8254eaf371e395a159ab1e
MD5 7df818cd2ce6dcfbdf2cc950e6387b18
SHA1 847914cb7303f6ae06ed22756c8976eac970a72f
SHA512 3642569f0ddfcfd6891297e1c38fb155c28a9f76a5e3ec5ef34672e8c403ebfc24cf87bad68a92edfc65f9951752b7fbfabc13bf8f457636415406828f1add6e
SSDEEP 393216:K1r17TS58Rf0bBcpIYl6976nI8sUlz+mPCspvcmhKx1X6t35x3a6eos5A:c17TSSR0bBqs8hztCSf4B6B5xaoI
TLSH
T1F937F1F620D2E7EDC01AC6FE8353F93FD64FB8354516A4BBA05CA2568922C847656F0C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpacked_fcam_pro.exe

File Explorer

unpacked_fcam_pro.exe

.exe 23.1MB

unpacked_fcam_pro.exe

IMPHASH 69e39a755fa914ff3d15763c0514b272
SHA256 08f80c7a347a5eb8ffd9743001b990b40598aa336f8254eaf371e395a159ab1e
MD5 7df818cd2ce6dcfbdf2cc950e6387b18
SHA1 847914cb7303f6ae06ed22756c8976eac970a72f
SHA512 3642569f0ddfcfd6891297e1c38fb155c28a9f76a5e3ec5ef34672e8c403ebfc24cf87bad68a92edfc65f9951752b7fbfabc13bf8f457636415406828f1add6e
SSDEEP 393216:K1r17TS58Rf0bBcpIYl6976nI8sUlz+mPCspvcmhKx1X6t35x3a6eos5A:c17TSSR0bBqs8hztCSf4B6B5xaoI
TLSH
T1F937F1F620D2E7EDC01AC6FE8353F93FD64FB8354516A4BBA05CA2568922C847656F0C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

52400

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

LockResource GetModuleHandleW IsDebuggerPresent CreateDirectoryW SizeofResource SetConsoleCtrlHandler AddDllDirectory GetCommandLineW GetStdHandle WriteFile GetShortPathNameW TerminateProcess GetModuleFileNameW SetEnvironmentVariableW K32GetModuleFileNameExW GetEnvironmentVariableW GetTempPathW FindResourceA WaitForSingleObject CreateFileW GetFileAttributesW GetModuleHandleA OpenProcess Sleep GetLastError GetCurrentThreadId CloseHandle LoadResource GetProcAddress GetCurrentProcessId CreateProcessW GetSystemTimeAsFileTime FormatMessageA LoadLibraryExW GetExitCodeProcess RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent QueryPerformanceCounter InitializeSListHead

shell32

SHFileOperationW SHGetFolderPathW CommandLineToArgvW

vcruntime140

wcschr __C_specific_handler __current_exception __current_exception_context memset memcpy memcpy

ucrtbase

mbstowcs wcstoul free malloc _set_new_mode _configthreadlocale __setusermatherr terminate abort _seh_filter_exe _set_app_type __p___wargv _errno _initialize_wide_environment _get_initial_wide_environment _initterm _initterm_e _Exit exit __p___argc _cexit _c_exit _register_thread_local_exe_atexit_callback _configure_wide_argv _crt_atexit _initialize_onexit_table _register_onexit_function puts __stdio_common_vsprintf __stdio_common_vfprintf _set_fmode __acrt_iob_func __p__commode __stdio_common_vswprintf _wcsdup iswctype wcsncmp _wcsicmp

Name

.text

Size

49KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

20KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

512B

Virtual Size

160KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

13.6MB

Virtual Size

13.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.idata

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

43KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

5.9MB

Virtual Size

5.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

3.5MB

Virtual Size

3.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.SCY

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

unpacked_fcam_pro.exe

kernel32

shell32

vcruntime140

ucrtbase

generic