YourMapper[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
YourMapper.exe
Size 3.9MB
Sample260723-rt67ss1bng
SHA256 57ed53ba0ac715c8de18c67eb2e8dc0d04a061208f4a9947fed350e83a5fda72
MD5 b7a6aae627a16e3e67825503c826933f
SHA1 3b5385e392aec43b4507e145f50c895db31e9525
SHA512 369e83401930695c2a01a307294727a3b749e991dbbf707e34842c930743ad334c5242a8cb062b31a4caddd2c70465cc3a75fec8c8919f04ef62f6397e46e0a3
SSDEEP 98304:utftYwaghIxulQullaedyxX5zujLOn6ocWwywq/9:PDvMCxX5b6ocewq/9
TLSH
T1601633BEB7A14703CFFD33B59309CB4A8A37A9059444F5E73A32FB66885A53F8054168
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
YourMapper.exe

File Explorer

YourMapper.exe

.exe 3.9MB

YourMapper.exe

SHA256 57ed53ba0ac715c8de18c67eb2e8dc0d04a061208f4a9947fed350e83a5fda72
MD5 b7a6aae627a16e3e67825503c826933f
SHA1 3b5385e392aec43b4507e145f50c895db31e9525
SHA512 369e83401930695c2a01a307294727a3b749e991dbbf707e34842c930743ad334c5242a8cb062b31a4caddd2c70465cc3a75fec8c8919f04ef62f6397e46e0a3
SSDEEP 98304:utftYwaghIxulQullaedyxX5zujLOn6ocWwywq/9:PDvMCxX5b6ocewq/9
TLSH
T1601633BEB7A14703CFFD33B59309CB4A8A37A9059444F5E73A32FB66885A53F8054168
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Password

Minor OS version

Major OS version

Entry point

6525016

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

Size

36KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

29KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

2KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

264B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

Virtual Size

6.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

3.8MB

Virtual Size

3.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

16B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

YourMapper.exe

generic