pirathook[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
pirathook.exe
Size 5.2MB
Sample260709-t28rpsev71
SHA256 f189deabc5333fb1b0953c31e813a5f9e65c5473f12b4877d20b93c0b55b09c2
MD5 c691ffe2d99640230174d323dc32525b
SHA1 10aab2c86ef89648bcedc64991b107be3ae871e9
SHA512 23fc609b21aa14e86a2c0b10332a9c2afd3571bba27f7aaa45a105e8bb14e3783c875c44edcccdbdfaa53cc73eca54779893f66d3b1fe128c7664be6fbc3edac
SSDEEP 98304:NTLQUGqcqlHuNEJ87D4rmXP8HXPTkgOENFbypL727ekn0s9hnK3s+Wg1DRcrk2yp:p5cUg1GPwglnbyd27ekn0EA3syNekZFr
TLSH
T1A34633460F8AB969D64922B09205808F8340EB0E8F6B7E5DBC3BEF77954F14C5796B48
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
pirathook.exe

File Explorer

pirathook.exe

.exe 5.2MB

pirathook.exe

SHA256 f189deabc5333fb1b0953c31e813a5f9e65c5473f12b4877d20b93c0b55b09c2
MD5 c691ffe2d99640230174d323dc32525b
SHA1 10aab2c86ef89648bcedc64991b107be3ae871e9
SHA512 23fc609b21aa14e86a2c0b10332a9c2afd3571bba27f7aaa45a105e8bb14e3783c875c44edcccdbdfaa53cc73eca54779893f66d3b1fe128c7664be6fbc3edac
SSDEEP 98304:NTLQUGqcqlHuNEJ87D4rmXP8HXPTkgOENFbypL727ekn0s9hnK3s+Wg1DRcrk2yp:p5cUg1GPwglnbyd27ekn0EA3syNekZFr
TLSH
T1A34633460F8AB969D64922B09205808F8340EB0E8F6B7E5DBC3BEF77954F14C5796B48
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9461848

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

Size

770KB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

399KB

Virtual Size

640KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

509KB

Virtual Size

814KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

38KB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

275B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

2KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.imports

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

Virtual Size

6.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

3.5MB

Virtual Size

3.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

16B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

pirathook.exe

generic