Injector[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Injector.exe
Size 9.5MB
Sample260622-wea82aex5j
SHA256 38c98fcd8d581bf0f00eb872e5ab11f314bd4613a8f50fb259e32334e15762ed
MD5 d3829211a9dce456feba040214a19a24
SHA1 f7cf96869e560eec9277557cdf7f97e7b85df33f
SHA512 fa25bf37ac781388312edcf0bba01c81cdd2939a8bed2a2a495718f1bebb0bf242b6bb7501e0058c5a44ecc3f1a7e745493ddfb0c2c6f975845a8fc1279cd450
SSDEEP 98304:49X9LAX2VVy2yPxToIFqqYR3NTeyqNxEGCEnBRT1LIV8SFv6R8VzFD4UjrEHE3Ma:4V7Ha5TITeDxJBZtR8R94aMWy0HO+O
TLSH
T1FBA69EF721C26BDFC46AC4BB8313FDBF864FB0751A2AA5E39158E2A64E16C403615F05
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Injector.exe

File Explorer

Injector.exe

.exe 9.5MB

Injector.exe

SHA256 38c98fcd8d581bf0f00eb872e5ab11f314bd4613a8f50fb259e32334e15762ed
MD5 d3829211a9dce456feba040214a19a24
SHA1 f7cf96869e560eec9277557cdf7f97e7b85df33f
SHA512 fa25bf37ac781388312edcf0bba01c81cdd2939a8bed2a2a495718f1bebb0bf242b6bb7501e0058c5a44ecc3f1a7e745493ddfb0c2c6f975845a8fc1279cd450
SSDEEP 98304:49X9LAX2VVy2yPxToIFqqYR3NTeyqNxEGCEnBRT1LIV8SFv6R8VzFD4UjrEHE3Ma:4V7Ha5TITeDxJBZtR8R94aMWy0HO+O
TLSH
T1FBA69EF721C26BDFC46AC4BB8313FDBF864FB0751A2AA5E39158E2A64E16C403615F05
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

271952

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

Size

273KB

Virtual Size

273KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

217KB

Virtual Size

217KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

480B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.imports

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

5.7MB

Virtual Size

5.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

3.3MB

Virtual Size

3.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ

Name

.import

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Injector.exe

generic