tarzfn_cracked_obf_protected[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
tarzfn_cracked_obf_protected.exe
Size 31.7MB
Sample260916-w4babssvdt
SHA256 b7ec6c30af5d96a610885c82e26afc189f3988f41bc78a0db9046305c86633b1
MD5 7925381de2ab5a763dbefafaf337fe8d
SHA1 77d18e5d2e8e717469065d5f18b97b23ddb4559f
SHA512 1efe590b9f62153c04c2592687492145f17aed2bb5e5e90c614eeb9b0cb95bd272cc322168cfce38de4a00dff61dabd2886fbebac9b6fb2ff864492cc9ce8ae1
SSDEEP 786432:hPeRN6D4ugTbbglNNGq+C1lRIgTEHCjUDGzmiKF4kLD:hMN68rfglr+XyxaUkLD
TLSH
T1F77733AE961013B0EB624B78AA3E4D6492CF43D4EB115C9C757293F2546FECE5CF01A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
tarzfn_cracked_obf_protected.exe

File Explorer

tarzfn_cracked_obf_protected.exe

.exe 31.7MB

tarzfn_cracked_obf_protected.exe

SHA256 b7ec6c30af5d96a610885c82e26afc189f3988f41bc78a0db9046305c86633b1
MD5 7925381de2ab5a763dbefafaf337fe8d
SHA1 77d18e5d2e8e717469065d5f18b97b23ddb4559f
SHA512 1efe590b9f62153c04c2592687492145f17aed2bb5e5e90c614eeb9b0cb95bd272cc322168cfce38de4a00dff61dabd2886fbebac9b6fb2ff864492cc9ce8ae1
SSDEEP 786432:hPeRN6D4ugTbbglNNGq+C1lRIgTEHCjUDGzmiKF4kLD:hMN68rfglr+XyxaUkLD
TLSH
T1F77733AE961013B0EB624B78AA3E4D6492CF43D4EB115C9C757293F2546FECE5CF01A8
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

37195864

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

Size

291KB

Virtual Size

481KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

23.8MB

Virtual Size

23.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

2KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

1024B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.idata

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.themida

Size

Virtual Size

11.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

7.6MB

Virtual Size

7.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

16B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

tarzfn_cracked_obf_protected.exe

generic