KirkinatorBootstrapper[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
KirkinatorBootstrapper.exe
Size 3.2MB
Sample260723-wp49vsstcw
SHA256 8e6c38320ff9520bee5cacd6def91c7d396738319e2f0f4b513a1b34a9ef004a
MD5 31af289a96672f1022d74d2ffce954f5
SHA1 fea8114ce99ba8698725ec3ae40bc41d33f4d25f
SHA512 eca490c4d0fe646c3d1444b26f8e214754074ea95aa80c8979bd9e59f6902597e22066a73f489965e1df31babfd80f32e5a57bfc80f267361ec856d49fb1dee5
SSDEEP 49152:ESm8fQTmcp85DKUN9TSbV3hAE/NCx0OcK/x86XieUPVzXeGiZkc4z3Nfm5Md:E/qJKaAVxflCWOzx86Xw5e4c49Fd
TLSH
T1ECF5336155DAB50ECA7E1BB5CAF81D1E506AAEC4ECB92FCC98604E0DAC00E24F7DD45C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
KirkinatorBootstrapper.exe

File Explorer

KirkinatorBootstrapper.exe

.exe 3.2MB

KirkinatorBootstrapper.exe

SHA256 8e6c38320ff9520bee5cacd6def91c7d396738319e2f0f4b513a1b34a9ef004a
MD5 31af289a96672f1022d74d2ffce954f5
SHA1 fea8114ce99ba8698725ec3ae40bc41d33f4d25f
SHA512 eca490c4d0fe646c3d1444b26f8e214754074ea95aa80c8979bd9e59f6902597e22066a73f489965e1df31babfd80f32e5a57bfc80f267361ec856d49fb1dee5
SSDEEP 49152:ESm8fQTmcp85DKUN9TSbV3hAE/NCx0OcK/x86XieUPVzXeGiZkc4z3Nfm5Md:E/qJKaAVxflCWOzx86Xw5e4c49Fd
TLSH
T1ECF5336155DAB50ECA7E1BB5CAF81D1E506AAEC4ECB92FCC98604E0DAC00E24F7DD45C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6086744

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

Size

109KB

Virtual Size

209KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

30KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

970B

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

6KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

267B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

1KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.imports

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

Virtual Size

5.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

KirkinatorBootstrapper.exe

generic