iontemp[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
iontemp.exe
Size 4.5MB
Sample260822-2cfcvsgf43
SHA256 05d2d9b4e0bd7f66541fb5f8f1534a95822d37e1ccbfc741e5890489694a5e28
MD5 04a28a66dc4c969cdf7c4668fe50d11b
SHA1 9cf48c18bdfa8d285e9c91fb9d24992196b5b62c
SHA512 74be4fb91ee40db7defb1ab9f013615a7c924da07b8f60e082d2d6d78a9bae513218c208504ddc1d8da04e28d5acc866599e1d7c835cc894eb30c86412190f8f
SSDEEP 98304:OFbjgUXdZdz7H87fy+iOh+CGVfkzpm09O2lyigQwyZlz:OFvTRz7hNOh+XdkzpnO2po4
TLSH
T1CB2633B432D32C46F2BF9E792FE6A5454238DE9B346D4733268138027DDA369350726E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
iontemp.exe

File Explorer

iontemp.exe

.exe 4.5MB

iontemp.exe

SHA256 05d2d9b4e0bd7f66541fb5f8f1534a95822d37e1ccbfc741e5890489694a5e28
MD5 04a28a66dc4c969cdf7c4668fe50d11b
SHA1 9cf48c18bdfa8d285e9c91fb9d24992196b5b62c
SHA512 74be4fb91ee40db7defb1ab9f013615a7c924da07b8f60e082d2d6d78a9bae513218c208504ddc1d8da04e28d5acc866599e1d7c835cc894eb30c86412190f8f
SSDEEP 98304:OFbjgUXdZdz7H87fy+iOh+CGVfkzpm09O2lyigQwyZlz:OFvTRz7hNOh+XdkzpnO2po4
TLSH
T1CB2633B432D32C46F2BF9E792FE6A5454238DE9B346D4733268138027DDA369350726E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8671320

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

Size

662KB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

147KB

Virtual Size

325KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

421KB

Virtual Size

905KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

27KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

2KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.imports

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.themida

Size

Virtual Size

5.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

3.3MB

Virtual Size

3.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

16B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

iontemp.exe

generic