d7MoonWalk[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
d7MoonWalk.exe
Size 6.6MB
Sample260727-cmlvysha22
SHA256 d15ebf8b15d16942e18a37a00f6e4ee924efdbfa00ba1ab14428e92c5ecd7968
MD5 d18e75c6fa5384cedb76f9e6d34a7fea
SHA1 766baac5391c2b84fb0d3be854d9ab25ce5e4009
SHA512 f5ee77e9049ea64fc7a00de04e67ea69117c6b8a6796d27c8ee7437d2387546d684f19f03aeabc815c3ec1d348315d3764785b54e16d3740eee428d5e837ccc5
SSDEEP 196608:ztIxQvgsndki8/cINlJ2W3mtAALvvx5Wt/U6UGYX:ZIxwdkieBZ3BALvxclR8X
TLSH
T1076633E90DC5BB9EC6687F73DA90E1A127179BB595412E0F3FB805D5FA63A26C31200C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d7MoonWalk.exe

File Explorer

d7MoonWalk.exe

.exe 6.6MB

d7MoonWalk.exe

SHA256 d15ebf8b15d16942e18a37a00f6e4ee924efdbfa00ba1ab14428e92c5ecd7968
MD5 d18e75c6fa5384cedb76f9e6d34a7fea
SHA1 766baac5391c2b84fb0d3be854d9ab25ce5e4009
SHA512 f5ee77e9049ea64fc7a00de04e67ea69117c6b8a6796d27c8ee7437d2387546d684f19f03aeabc815c3ec1d348315d3764785b54e16d3740eee428d5e837ccc5
SSDEEP 196608:ztIxQvgsndki8/cINlJ2W3mtAALvvx5Wt/U6UGYX:ZIxwdkieBZ3BALvxclR8X
TLSH
T1076633E90DC5BB9EC6687F73DA90E1A127179BB595412E0F3FB805D5FA63A26C31200C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10043480

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

Size

447KB

Virtual Size

792KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

165KB

Virtual Size

346KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

23KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

1KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.idata

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

Virtual Size

6.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

3.7MB

Virtual Size

3.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

16B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

d7MoonWalk.exe

generic