MXA AIMBOT AI[.]rar

General

Target
MXA AIMBOT AI.rar
Size 5.7MB
Sample260522-qa4f5aes8x
SHA256 066a3f7646484ff4516ba3c160f87c43a5f88750279ea62cdc7e716ab6b5de1d
MD5 62cc5098e503194188a12e90fb1971da
SHA1 bdc835db5ca5639925ee889902c007f6e1ae6853
SHA512 3ca0042316022ebdc7c5d914c14763296dd5e5c479dc7dfe1ec3bc7481da5faa03cf5e9d6b8a8f52275e6dbd3348b3cbb8ba7448a32a3d84d4b66810e5072d9f
SSDEEP 98304:uS2Zgl5MkhXwjBDjNCN5j0ZA5QBnmXvbDDjJxUWpEQxZ1Z+sfG84ZSGEM4pRJuOn:uZglekBg7CN5j/5ImwcxJtUoM4pObO6w
TLSH
T16256335935B0DF29BF944AE006BDF67FF1CEA02D264412D531CDA6529CACFB12A0D883
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
static1/unpack001/MXA AIMBOT AI.exe	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/MXA AIMBOT AI.exe

File Explorer

MXA AIMBOT AI.rar

.rar 5.7MB
MXA AIMBOT AI.exe

.exe 5.9MB

MXA AIMBOT AI.rar

SHA256 066a3f7646484ff4516ba3c160f87c43a5f88750279ea62cdc7e716ab6b5de1d
MD5 62cc5098e503194188a12e90fb1971da
SHA1 bdc835db5ca5639925ee889902c007f6e1ae6853
SHA512 3ca0042316022ebdc7c5d914c14763296dd5e5c479dc7dfe1ec3bc7481da5faa03cf5e9d6b8a8f52275e6dbd3348b3cbb8ba7448a32a3d84d4b66810e5072d9f
SSDEEP 98304:uS2Zgl5MkhXwjBDjNCN5j0ZA5QBnmXvbDDjJxUWpEQxZ1Z+sfG84ZSGEM4pRJuOn:uZglekBg7CN5j/5ImwcxJtUoM4pObO6w
TLSH
T16256335935B0DF29BF944AE006BDF67FF1CEA02D264412D531CDA6529CACFB12A0D883
MD5 SHA1 SHA512 SSDEEP TLSH

Password

1

MXA AIMBOT AI.exe

SHA256 dccda3213d826835a4619abb45efd7e9dbe2a078d6901ff603a8813513ed34b5
MD5 c6640144cc75c7f7ac6b644e62217132
SHA1 0f2c0d9817152b79b51c74f3f6f313bc9cbcceb5
SHA512 0cc8788e2d4020873bbbe50ef57755903d995d99db3ebfaa2ef5fb0346494600f33cf25c188dd09498f4e60cf63e525056ef0e688dc43ccb83e5227ba4ca91ce
SSDEEP 98304:m0f+nppeFxa1oTHqIpLRU5oTHJvs1qZLmI1u4O9PWLl2FdrW5IHfGjmRRU:nK2FwAHqItRPviqZLmPuLEzr9CmXU
TLSH
T1F25633E22A54D8DDD1457E3A4D9183FA00E39D84CCE8485A738E324D75F9C246EDBBAC
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Password

1

Minor OS version

0

Major OS version

4

Entry point

10158168

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

Size

1.8MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

65KB

Virtual Size

188KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.imports

Size

512B

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

188KB

Virtual Size

188KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

Virtual Size

6.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

3.8MB

Virtual Size

3.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

MXA AIMBOT AI.rar

MXA AIMBOT AI.exe

generic