obfffffmach0000[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
obfffffmach0000.exe
Size 2.8MB
Sample260924-dpr1esysc1
SHA256 0f058f66e58e1cd18e60cb6a66f0eda5b85de0ad7950f20bfe36e4261b98b411
MD5 7af420cbe052a5955acba49535afb76f
SHA1 ee1d3603676e08ec0649cbacc005ecc28843c68b
SHA512 fcfa2ca7f364a9bc1bc121f4b559368699a4b751e6c40f5cba6762368dbe4d61d9eeec4188ba68d4f8c841a4876266ba3cba5e68062e24b512ca9012adb4652c
SSDEEP 49152:H1ODYAaXvbHFcpSUxRaDWaWifZE0wqaT4wxoWSf8zWWgNy6hdG879HTY:IkAaXpcpSUzaDWap60w9KG6NjHTY
TLSH
T100D533870E86912FEC9E6D3D08A86B572E488F5BA7575D88BAFF00C40105F8DEF659D0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
obfffffmach0000.exe

File Explorer

obfffffmach0000.exe

.exe 2.8MB

obfffffmach0000.exe

SHA256 0f058f66e58e1cd18e60cb6a66f0eda5b85de0ad7950f20bfe36e4261b98b411
MD5 7af420cbe052a5955acba49535afb76f
SHA1 ee1d3603676e08ec0649cbacc005ecc28843c68b
SHA512 fcfa2ca7f364a9bc1bc121f4b559368699a4b751e6c40f5cba6762368dbe4d61d9eeec4188ba68d4f8c841a4876266ba3cba5e68062e24b512ca9012adb4652c
SSDEEP 49152:H1ODYAaXvbHFcpSUxRaDWaWifZE0wqaT4wxoWSf8zWWgNy6hdG879HTY:IkAaXpcpSUzaDWap60w9KG6NjHTY
TLSH
T100D533870E86912FEC9E6D3D08A86B572E488F5BA7575D88BAFF00C40105F8DEF659D0
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4972632

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

Size

15KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

2KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

512B

Virtual Size

840B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.idata

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

Virtual Size

4.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

obfffffmach0000.exe

generic