vv[.]exe | Triage™

General

Target
vv.exe
Size 17.2MB
Sample260626-b665kahs3n
SHA256 a834688f33eb057cad75deefed808f78f39ff9841284d968ee61d59e46887868
MD5 c4eb4558238c6d90991ea16ee6278045
SHA1 a3da698208e82e715c87df6f33585b51d5a9a731
SHA512 884d1e8e01f7f5c2963b1ed2ab32954249003b02436daba161345dd9c5ad1789ce7e811c2b82be0c2728ffc8d01dfef67781d0cec76ebc0d7301826b03d838ce
SSDEEP 393216:d5gkKf7jbbRgFvqBTbkPvNPgSNshgjMue75+EA7gxjnW:d5gkO3dgveTgPV4gw8MdxmgxjnW
TLSH
T1340733619D139099DA67CFF7039DC412AAA95031DACADC7EAD061EC5FF34FA0ED08612
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
vv.exe

File Explorer

vv.exe

.exe 17.2MB

vv.exe

SHA256 a834688f33eb057cad75deefed808f78f39ff9841284d968ee61d59e46887868
MD5 c4eb4558238c6d90991ea16ee6278045
SHA1 a3da698208e82e715c87df6f33585b51d5a9a731
SHA512 884d1e8e01f7f5c2963b1ed2ab32954249003b02436daba161345dd9c5ad1789ce7e811c2b82be0c2728ffc8d01dfef67781d0cec76ebc0d7301826b03d838ce
SSDEEP 393216:d5gkKf7jbbRgFvqBTbkPvNPgSNshgjMue75+EA7gxjnW:d5gkO3dgveTgPV4gw8MdxmgxjnW
TLSH
T1340733619D139099DA67CFF7039DC412AAA95031DACADC7EAD061EC5FF34FA0ED08612
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

27697240

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

Size

2KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

1024B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.idata

Size

512B

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

Virtual Size

26.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

17.1MB

Virtual Size

17.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

vv.exe

generic