dcc435cb82ffe739d21ce3cb68c0c796b87b7142e7aef907fa6840140b937e55[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
dcc435cb82ffe739d21ce3cb68c0c796b87b7142e7aef907fa6840140b937e55.zip
Size 16.5MB
Sample260808-srj5xstsfy
SHA256 680a191f29a80a1be9aea25c7c13f2398e2e18043bafa671b566a19cacb17d3a
MD5 eed3ac568df9ad556eb6a252d2cb0b48
SHA1 b26831bb372acde6bb95c45ab54d644ffa1bab52
SHA512 6ad719602ff4514f3472457c30dd4240c8610d5e42f547c0fc4e28d47b6bd4f755923765c13819885cd6d5ebb66ae969058e23bf5b7409e9662d110d5ac021e1
SSDEEP 393216:nGdfN943w+jau1Zm49fZkeDQSc9+iLM7SJryw96jkACnN3/gsEq:nGdfNOg+jauXmSfrZTiLM496jyF5Eq
TLSH
T11B073396D6E5AF39881BA932012030FC9BC49F8F874D5EE04715C968B51AF3E77980EC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
static1/unpack001/dcc435cb82ffe739d21ce3cb68c0c796b87b7142e7aef907fa6840140b937e55	themida

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/dcc435cb82ffe739d21ce3cb68c0c796b87b7142e7aef907fa6840140b937e55	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/dcc435cb82ffe739d21ce3cb68c0c796b87b7142e7aef907fa6840140b937e55

File Explorer

dcc435cb82ffe739d21ce3cb68c0c796b87b7142e7aef907fa6840140b937e55.zip

.zip 16.5MB
dcc435cb82ffe739d21ce3cb68c0c796b87b7142e7aef907fa6840140b937e55

.exe 31.5MB

dcc435cb82ffe739d21ce3cb68c0c796b87b7142e7aef907fa6840140b937e55.zip

SHA256 680a191f29a80a1be9aea25c7c13f2398e2e18043bafa671b566a19cacb17d3a
MD5 eed3ac568df9ad556eb6a252d2cb0b48
SHA1 b26831bb372acde6bb95c45ab54d644ffa1bab52
SHA512 6ad719602ff4514f3472457c30dd4240c8610d5e42f547c0fc4e28d47b6bd4f755923765c13819885cd6d5ebb66ae969058e23bf5b7409e9662d110d5ac021e1
SSDEEP 393216:nGdfN943w+jau1Zm49fZkeDQSc9+iLM7SJryw96jkACnN3/gsEq:nGdfNOg+jauXmSfrZTiLM496jyF5Eq
TLSH
T11B073396D6E5AF39881BA932012030FC9BC49F8F874D5EE04715C968B51AF3E77980EC
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

dcc435cb82ffe739d21ce3cb68c0c796b87b7142e7aef907fa6840140b937e55

SHA256 dcc435cb82ffe739d21ce3cb68c0c796b87b7142e7aef907fa6840140b937e55
MD5 13244498904854d964f4ad59d139edb7
SHA1 a70d76a34a81777a2a32fb2c5cf309321454380e
SHA512 2b1b7fbfd7cda989a94e0125c2a4a7f75cd0ea582eebc126cb23b4c30e3cc27a9fbc32958f85ae559d284ab9ef7e89045da7eab22ce885d4f343627b6bf73a6d
SSDEEP 393216:NVxp2scXX2APu4fY6Hu6pdwf9Lkc50JG/:NVxUscXX2AGI51yR
TLSH
T11B778ED211D4108AE566FBBDBA16EA9FEABF7429372769D70084C04D7B03C9137AE50C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

27963480

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

Size

12.3MB

Virtual Size

12.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

212KB

Virtual Size

220KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

34KB

Virtual Size

420KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

159KB

Virtual Size

160KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

4.5MB

Virtual Size

4.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.idata

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

43KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

9.0MB

Virtual Size

9.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

5.2MB

Virtual Size

5.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

dcc435cb82ffe739d21ce3cb68c0c796b87b7142e7aef907fa6840140b937e55.zip

dcc435cb82ffe739d21ce3cb68c0c796b87b7142e7aef907fa6840140b937e55

generic