Installer[.]iso | Triage™

General

Target
Installer.iso
Size 18.9MB
Sample260910-lml1dst1bx
SHA256 c489ffa503624d6de25bed8ea8b340c6f9caa239010b47bb4e433c4dc360b30c
MD5 6d6614c0266be35c24fc9cfb657e9d45
SHA1 6012a4c5b457e42f3e4f0cccdf923a3c19424f51
SHA512 98abe8c177e7db9cdc8bc8c08b692735f358414adcc9c8d66a0e309111e0c50cafa57a7608d523c5cf43a5d7533a16fe6ae6a126c09ebb327b3cebcdf5418165
SSDEEP 393216:LAyTJ4fhttfpCr4FVU912QFtS0wNrqkauqQWG0uA1U9Vr2RMxcjiCV+:LAJw4FVUHjor/n7WG05tUCV+
TLSH
T1F71733E4C389F4D5C51A8F70FF0E5289DCB245957D05C718F90EA3AEA3F3821B469A26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
static1/unpack002/Installer_v3931_x64_.exe	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack002/Installer_v3931_x64_.exe

File Explorer

Installer.iso

.iso 18.9MB
out.iso

.iso 18.9MB
Installer_v3931_x64_.exe

.exe 18.8MB
ReadMe.txt

760B

Installer.iso

SHA256 c489ffa503624d6de25bed8ea8b340c6f9caa239010b47bb4e433c4dc360b30c
MD5 6d6614c0266be35c24fc9cfb657e9d45
SHA1 6012a4c5b457e42f3e4f0cccdf923a3c19424f51
SHA512 98abe8c177e7db9cdc8bc8c08b692735f358414adcc9c8d66a0e309111e0c50cafa57a7608d523c5cf43a5d7533a16fe6ae6a126c09ebb327b3cebcdf5418165
SSDEEP 393216:LAyTJ4fhttfpCr4FVU912QFtS0wNrqkauqQWG0uA1U9Vr2RMxcjiCV+:LAJw4FVUHjor/n7WG05tUCV+
TLSH
T1F71733E4C389F4D5C51A8F70FF0E5289DCB245957D05C718F90EA3AEA3F3821B469A26
MD5 SHA1 SHA512 SSDEEP TLSH

Installer_v3931_x64_.exe

SHA256 3d006229cbe5f32f036b0f10ee2876a1d2e9434639c8ba934704d31f73688f0c
MD5 a8672b5a73301420360167933bc6c1f1
SHA1 c29bbb61a49331f2ccbd47871eb26f37165955aa
SHA512 e07a8dcb0384d62f7959408f4246de81b622047232e2a1e1626f69d61130f4efd73b0ffb8415773544c5a32d695b4185b07d55b2a7e0238f834f1bfb9d3e51d3
SSDEEP 393216:nAyTJ4fhttfpCr4FVU912QFtS0wNrqkauqQWG0uA1U9Vr2RMxcjiCV+:nAJw4FVUHjor/n7WG05tUCV+
TLSH
T1031733E8C389F4D5C51A8F70FF0E5289DCB245957D05C718E90EA3BEA3F2821F469926
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

22954072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

Size

14.3MB

Virtual Size

14.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

12KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

512B

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

81KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

Virtual Size

7.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

4.5MB

Virtual Size

4.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

Installer.iso

out.iso

Installer_v3931_x64_.exe

generic

ReadMe.txt