Release[.]rar | Triage™

General

Target
Release.rar
Size 4.8MB
Sample260710-ezryvaes8x
SHA256 93b83b7cefb5e1381e190185c1004ef8759841132af286528dca1be93dbf46f8
MD5 562cb3b65e82a883f41aa04e72f2dff7
SHA1 d41dee285200c8a4590c18cdf96fc3d68b4116df
SHA512 267a3d880f61bd28dc6fb82280ecf454ab91ef257a614f8c5057b5039e725fd8bbc38d55c230752db239e64ba3e8fe0f0806c8eb14b494f925a1a0a124ed1698
SSDEEP 98304:7GeNGimQIMwFjAms/v6OH9dwZy9vzrBcJ6CFfu+A:y9imLMpmqxH9MGHe6CFfuP
TLSH
T181363389311CBA22DDB9633E7BFD9CBCE2CAA7D9B60C0775C60515B7980492C08ED64D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
static1/unpack001/Verdent Unlocker by Hwid and FlushDNS.exe	themida

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Verdent New Signature.pfx
unpack001/Verdent Unlocker by Hwid and FlushDNS.exe

File Explorer

Release.rar

.rar 4.8MB
Verdent New Signature.pfx

.exe 790KB
Verdent Unlocker by Hwid and FlushDNS.exe

.exe 4.8MB

Release.rar

SHA256 93b83b7cefb5e1381e190185c1004ef8759841132af286528dca1be93dbf46f8
MD5 562cb3b65e82a883f41aa04e72f2dff7
SHA1 d41dee285200c8a4590c18cdf96fc3d68b4116df
SHA512 267a3d880f61bd28dc6fb82280ecf454ab91ef257a614f8c5057b5039e725fd8bbc38d55c230752db239e64ba3e8fe0f0806c8eb14b494f925a1a0a124ed1698
SSDEEP 98304:7GeNGimQIMwFjAms/v6OH9dwZy9vzrBcJ6CFfu+A:y9imLMpmqxH9MGHe6CFfuP
TLSH
T181363389311CBA22DDB9633E7BFD9CBCE2CAA7D9B60C0775C60515B7980492C08ED64D
MD5 SHA1 SHA512 SSDEEP TLSH

Password

b59n495vyn975ynv74y5

Verdent New Signature.pfx

SHA256 0111438830856a6790d43a429bfa7ac1e4ffc677f9fbf1d17eace6799e96acde
MD5 50a6f9d2abc8f031668a4d2bd4f4a874
SHA1 a40d2cf88264e4d9999810e02a7b67de00a148fb
SHA512 e2326e93fd545316842968feaf41a26201b306fcaae2365b0aa41c4d86d523a99a0e711528affa8a960b62a191342de26fc9221f945c38a9ddba96ca456a873f
SSDEEP 12288:DOmrQdAPTCLGh7RHqvKVKtbWqk4Wr6WfIFzY9JCJZnc:NsADhlqCVKtbW8FWwhYHCJZc
TLSH
T1E2059D2637D84966D5AF57B8F0F2191303B1B4423522EB4F5DC82EEB3D137919812BAB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

b59n495vyn975ynv74y5

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Verdent Unlocker by Hwid and FlushDNS.exe

SHA256 999c5a72cacc68dbff54d5fca2419b6b21f330273decf18df2ffb6a28b858f41
MD5 9d72d25f3858eee3ff6f7cc54956451c
SHA1 19492b5ab2fcd1a9b5a7788c98d4af1ee189666e
SHA512 d644770b704d20d6f9702a1fa967e8501f61d516649e421bd4239064c7818c800d6e182c19bf236ce6f21f2c726135f44c28f18a6b751df6951f95ed30314ba9
SSDEEP 98304:vOhl5u6sk/rNg8qEx4FjBcZX1E93aE58py+YEyJuWHar4VRP4:2h7YkeEuFdcD6aEGpy5ElWHHV94
TLSH
T1E5362292B98BB861D042F8F76883C0C9D6B2FC045E6C0B5365EC7B7AD9BDC650D1B192
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Password

b59n495vyn975ynv74y5

Minor OS version

0

Major OS version

4

Entry point

8740952

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

Size

108KB

Virtual Size

384KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

96KB

Virtual Size

366KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.imports

Size

512B

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

367KB

Virtual Size

367KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

Virtual Size

7.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

4.2MB

Virtual Size

4.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Release.rar

Verdent New Signature.pfx

generic

Verdent Unlocker by Hwid and FlushDNS.exe

generic

Sharing

General

Malware Config

Signatures

File Explorer

Release.rar

Verdent New Signature.pfx

generic

Verdent Unlocker by Hwid and FlushDNS.exe

generic