أداه 2[.]rar | Triage™

General

Target
أداه 2.rar
Size 1.9MB
Sample260821-e6mbyagm7w
SHA256 0a8bc6819cb893de5c62d2aa51362ec19c38815535efabb759cb0442756caf37
MD5 6fff9efa46e2825de64449e9be5745d4
SHA1 4e107683f6844778a05cf9e22b25e1f8708c286b
SHA512 d2e76f94bf7084a9d5ddd6225ebb3c364332d1dd875dcda85750d6f7e1e1a3d7a1aae0e912173675be43d2df899afecff285f546d14ac45f4dcb54ebba5c074d
SSDEEP 49152:jU8o7wu7a5MtxSMe9wxy3kn9tHPm9yK9oIZGwcNbYKOJ:oEeeMjF5xwkn9tH+9n9xZGwubFA
TLSH
T14A9533A90730C4CEFB0797CD771B6B233CA10494ADBD476B94F7688891D49EA22C9E19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
static1/unpack001/P2.exe	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/P2.exe

File Explorer

أداه 2.rar

.rar 1.9MB
P2.exe

.exe 2.0MB
paoR.txt

277B

أداه 2.rar

SHA256 0a8bc6819cb893de5c62d2aa51362ec19c38815535efabb759cb0442756caf37
MD5 6fff9efa46e2825de64449e9be5745d4
SHA1 4e107683f6844778a05cf9e22b25e1f8708c286b
SHA512 d2e76f94bf7084a9d5ddd6225ebb3c364332d1dd875dcda85750d6f7e1e1a3d7a1aae0e912173675be43d2df899afecff285f546d14ac45f4dcb54ebba5c074d
SSDEEP 49152:jU8o7wu7a5MtxSMe9wxy3kn9tHPm9yK9oIZGwcNbYKOJ:oEeeMjF5xwkn9tH+9n9xZGwubFA
TLSH
T14A9533A90730C4CEFB0797CD771B6B233CA10494ADBD476B94F7688891D49EA22C9E19
MD5 SHA1 SHA512 SSDEEP TLSH

P2.exe

SHA256 652aab2d537e3d581b2b58ace9733ee3ee8e9500143bc9e28d5caa4bfc7f8b25
MD5 3bc8f2226f3502ed98803525e4eb6c4f
SHA1 daf795a5012d382ef06029b33d3661ec04d773d0
SHA512 96c6c98bac3222e623ba90e30a1cdc74b3f93e6c22e672e3e73a27acb29830b418c2e6b4c4b1c2a0c709f8bbf788c6e0bdabb0e5c8c5c4eefe6e1b28790aa0eb
SSDEEP 49152:OM+doxUyNlh3Kx1yVg0lj5lch3vqpcwrJT6C32SlUi:OvKxUyNmSVg0lXcpvdM9B3L
TLSH
T10B95339448412D30D9F0FF320D16FAA78DADDC595224C013AB8FEFDA53961E68D29BC9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4153432

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

Size

11KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

512B

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.themida

Size

Virtual Size

3.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

أداه 2.rar

P2.exe

generic

paoR.txt