Crown[.]exe | Triage™

General

Target
Crown.exe
Size 6.1MB
Sample260807-zexntaaa29
SHA256 81e7bc2097821a829c4e1dbe5d75305207b5ee9dbeb08e31203a81a95d071d03
MD5 232cbc03d848e0124035ca62671f9fea
SHA1 d52c0440fdf658b66842231763d1a5fad72947fb
SHA512 98bbc1a10c37e8adc14431cefd70625c642ba83ca66ea4ffd225df3e44faf6c78cfca43222aa70f5756e3bc8ef2576addc6fb994391f6323600d481080de7b82
SSDEEP 196608:ORfxkCCQ/ACnV4hUdyy3DIGlxsc8yE0b8KmdZTG:gdR/DV4hUIy8XcyA
TLSH
T16356334F785CAF41D947E6B42E346C290B97C9674DAC67442A4E092EA4C7C3FB101FEA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Crown.exe

File Explorer

Crown.exe

.exe 6.1MB

Crown.exe

SHA256 81e7bc2097821a829c4e1dbe5d75305207b5ee9dbeb08e31203a81a95d071d03
MD5 232cbc03d848e0124035ca62671f9fea
SHA1 d52c0440fdf658b66842231763d1a5fad72947fb
SHA512 98bbc1a10c37e8adc14431cefd70625c642ba83ca66ea4ffd225df3e44faf6c78cfca43222aa70f5756e3bc8ef2576addc6fb994391f6323600d481080de7b82
SSDEEP 196608:ORfxkCCQ/ACnV4hUdyy3DIGlxsc8yE0b8KmdZTG:gdR/DV4hUIy8XcyA
TLSH
T16356334F785CAF41D947E6B42E346C290B97C9674DAC67442A4E092EA4C7C3FB101FEA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10453080

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

Size

575KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

1024B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

512B

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

Virtual Size

9.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

5.5MB

Virtual Size

5.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Crown.exe

generic