mir2patch[.]exe[.]gz

General

Target
mir2patch.exe.gz
Size 3.6MB
Sample260930-ph3n5avvdz
SHA256 ea7b4bbc69f725243488bd08adafbfaf7628f28c58506bb7c2159a7ed84393dd
MD5 7e984592300b866ea7adede96daf4fa0
SHA1 539e09279aefcdd19954665178a4c118e7f547aa
SHA512 f09828a9dd9cb8b31109bc0a38f776c84b065d058be66cec37b758668e1cd58b60ba10d1604012aa36a52034308adc996857d51eebada690c5479457ab23ee03
SSDEEP 98304:zFN/mT9AYWOXJYvk6F9cvfb+Et4kn8H5NpwiCf3q3hsfk:R7OX2vtIHtfnaZcfgak
TLSH
T1BF0633B348F4F5AFEA4D18B141AFE67BE205A151CB9CD25CA5F9813A246039F902D4CF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
mir2patch.exe.gz

File Explorer

mir2patch.exe.gz

.exe 3.6MB

mir2patch.exe.gz

SHA256 ea7b4bbc69f725243488bd08adafbfaf7628f28c58506bb7c2159a7ed84393dd
MD5 7e984592300b866ea7adede96daf4fa0
SHA1 539e09279aefcdd19954665178a4c118e7f547aa
SHA512 f09828a9dd9cb8b31109bc0a38f776c84b065d058be66cec37b758668e1cd58b60ba10d1604012aa36a52034308adc996857d51eebada690c5479457ab23ee03
SSDEEP 98304:zFN/mT9AYWOXJYvk6F9cvfb+Et4kn8H5NpwiCf3q3hsfk:R7OX2vtIHtfnaZcfgak
TLSH
T1BF0633B348F4F5AFEA4D18B141AFE67BE205A151CB9CD25CA5F9813A246039F902D4CF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

6176944

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

Size

665KB

Virtual Size

760KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

6KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

15B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.imports

Size

512B

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

Virtual Size

5.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

mir2patch.exe.gz

generic