PlusBot[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
PlusBot.exe
Size 3.9MB
Sample260710-cdgvmsbz2p
SHA256 41844d7b87e44de4371af2d0bb6cf216183772bbc427bd12bb4038d537defb0b
MD5 7bc2a6bd54d25688a9f7d66bc27f77fc
SHA1 a35f894351de7931020891f6ab00b7e3c99084b9
SHA512 b98e6054c942c9ca1889a926f2014a3aee033ff202356033dd2ec6fda4302c29ffc12a1ace6a70520f4cb3068ba419e22920ae552f8e7fd51d8ba158db43dd78
SSDEEP 98304:eS6HzLNGm+J6rWRCTld9hFjTJMcwz8EvJBTqv4EhboBCcjXwGO4dRkQwIE+JBb:eS6HFQgWsdzdJMvXzYhFcjAeduXIE+jb
TLSH
T1AD1633668BCD0538E6879BFCD7F1A1123E13E23C4B12A3C5505EA95B0977C1933BB6A1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
PlusBot.exe

File Explorer

PlusBot.exe

.exe 3.9MB

PlusBot.exe

SHA256 41844d7b87e44de4371af2d0bb6cf216183772bbc427bd12bb4038d537defb0b
MD5 7bc2a6bd54d25688a9f7d66bc27f77fc
SHA1 a35f894351de7931020891f6ab00b7e3c99084b9
SHA512 b98e6054c942c9ca1889a926f2014a3aee033ff202356033dd2ec6fda4302c29ffc12a1ace6a70520f4cb3068ba419e22920ae552f8e7fd51d8ba158db43dd78
SSDEEP 98304:eS6HzLNGm+J6rWRCTld9hFjTJMcwz8EvJBTqv4EhboBCcjXwGO4dRkQwIE+JBb:eS6HFQgWsdzdJMvXzYhFcjAeduXIE+jb
TLSH
T1AD1633668BCD0538E6879BFCD7F1A1123E13E23C4B12A3C5505EA95B0977C1933BB6A1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7487576

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

Size

261KB

Virtual Size

502KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

44KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

275KB

Virtual Size

849KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

12KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

275B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

349B

Virtual Size

364B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.imports

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

Virtual Size

5.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

3.3MB

Virtual Size

3.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

16B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

PlusBot.exe

generic