Installer[.]iso | Triage™

General

Target
Installer.iso
Size 16.2MB
Sample261007-e54jtssse1
SHA256 29ab58d7ef08f98ba4cb0e20b0989eb8460c6247283c530d41bc9dcf67a9e711
MD5 b5de2a03c256cbe4b89e8b4ea0da8df7
SHA1 aa64e137c6d4de7efec5deeec45f78efcd79e92f
SHA512 b45908a89871f53f13f457cfe358503d2939e70c62cb2ed8bdd1ea7a62cafacc05ccff043cae514aca05c9493aab315c223de4a8bcf1224e76d0658557d61f10
SSDEEP 393216:GpxQTv84vaMxyerYiSX6Rse9SWC6Yuh7Ueh:mRlesiNRseIpAV9h
TLSH
T1BB07337D3588042CE68CEE3B173BB58882EBBD362D389115F249F1BD5634AD152F1B29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
static1/unpack002/Installer21691x64.exe	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack002/Installer21691x64.exe

File Explorer

Installer.iso

.iso 16.2MB
out.iso

.iso 16.2MB
Installer21691x64.exe

.exe 16.1MB
ReadMe.txt

762B

Installer.iso

SHA256 29ab58d7ef08f98ba4cb0e20b0989eb8460c6247283c530d41bc9dcf67a9e711
MD5 b5de2a03c256cbe4b89e8b4ea0da8df7
SHA1 aa64e137c6d4de7efec5deeec45f78efcd79e92f
SHA512 b45908a89871f53f13f457cfe358503d2939e70c62cb2ed8bdd1ea7a62cafacc05ccff043cae514aca05c9493aab315c223de4a8bcf1224e76d0658557d61f10
SSDEEP 393216:GpxQTv84vaMxyerYiSX6Rse9SWC6Yuh7Ueh:mRlesiNRseIpAV9h
TLSH
T1BB07337D3588042CE68CEE3B173BB58882EBBD362D389115F249F1BD5634AD152F1B29
MD5 SHA1 SHA512 SSDEEP TLSH

Installer21691x64.exe

SHA256 749009376b352dfd21f7289f549c0ed3ff515f813eb1eaf2e604ba75be02c9c2
MD5 770e477b5f8cd94a6783140a3bb62225
SHA1 36c20408877494fe44a04809a7730efc0d0a323a
SHA512 df666499f7d927dfb5ad45472928aded35ae4b6178c77067e3bad40e95a49744e6d1e515b18eeb5cfc35a061e55b1cf879bc9d30188bcfd9f9136e893a1abffa
SSDEEP 393216:cpxQTv84vaMxyerYiSX6Rse9SWC6Yuh7Ueh:gRlesiNRseIpAV9h
TLSH
T1CD07337D31C8042CE68CEF3B173BB58882EBBD366D389125E245F1BD5534AE152F1A29
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

20119640

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

Size

11.4MB

Virtual Size

11.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

28KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

512B

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

67KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

Virtual Size

7.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

4.6MB

Virtual Size

4.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Installer.iso

out.iso

Installer21691x64.exe

generic

ReadMe.txt