NlULw3Sq5Z[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
NlULw3Sq5Z.exe
Size 12.0MB
Sample261009-y66kcsvw4n
SHA256 f91eba66184f72e8d9e086faecb2e93f2dfe27c534f5fc101f7c0b389a8f09fe
MD5 22f704de2c733e3f4d9fb9be1945ba1c
SHA1 3f37c80cd6dceadbb616237c65b43f17417a346d
SHA512 d7fb15dbe37d1e0ddfdbac701306e12d8902e892d055f9949a47567a61aabdb04702306acdf683a3e1bdb744e7b7b09fcd6b82dcb4654f38a2d4cd4eefebe647
SSDEEP 393216:V0PiB1GwsshFez048Q8KAQXA2/oxaTsrPVAp9SL:OPiBYns2VX8KAaAvxksr+pQL
TLSH
T12AD6331E1C857CD2E1E007766E2A10522F21EBB58E576BBDDA2F033A8D4444C6BF735A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NlULw3Sq5Z.exe

File Explorer

NlULw3Sq5Z.exe

.exe 12.0MB

NlULw3Sq5Z.exe

SHA256 f91eba66184f72e8d9e086faecb2e93f2dfe27c534f5fc101f7c0b389a8f09fe
MD5 22f704de2c733e3f4d9fb9be1945ba1c
SHA1 3f37c80cd6dceadbb616237c65b43f17417a346d
SHA512 d7fb15dbe37d1e0ddfdbac701306e12d8902e892d055f9949a47567a61aabdb04702306acdf683a3e1bdb744e7b7b09fcd6b82dcb4654f38a2d4cd4eefebe647
SSDEEP 393216:V0PiB1GwsshFez048Q8KAQXA2/oxaTsrPVAp9SL:OPiBYns2VX8KAaAvxksr+pQL
TLSH
T12AD6331E1C857CD2E1E007766E2A10522F21EBB58E576BBDDA2F033A8D4444C6BF735A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

29040728

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

Size

2.1MB

Virtual Size

5.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

927KB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

882KB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

153KB

Virtual Size

280KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

4.9MB

Virtual Size

12.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

27KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.vm_sec

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

Virtual Size

4.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

16B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

NlULw3Sq5Z.exe

generic