X86 Token Finder[.]rar

Sharing

Copy URL Twitter E-mail

General

Target
X86 Token Finder.rar
Size 10.0MB
Sample261030-njp9raysgw
SHA256 fa12b97c9b66ebb68c04c9eadd4585f5db9074ca17db85d67b58acb4f1f24261
MD5 c613d85f5bdc6a5a2c1654fa9a3cf910
SHA1 dffabba9331ced91d32a285383f3de9a52cace14
SHA512 d2590458f8f63b2f3cb908a76ef47eea92c78fd086da6084da1acfa4c0cac288c68d42b006f9080e46ce830386781090207d949443b09ccaf6fe3ee7f33bd23d
SSDEEP 196608:PBVAzVVlnMoOlRsOxmFU3MMrRmkN1xhGSUnmTI9RFJ1YguNN:PBVsV7MoOlRVo+MMFmkSSUmTk9b2
TLSH
T140B6334B7AA653BD61CBDA4E1C8035B8FDACC81307D25F44434B9201B9C67EF667A728
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
static1/unpack001/X86 Token Finder.exe	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/X86 Token Finder.exe

File Explorer

X86 Token Finder.rar

.rar 10.0MB
X86 Token Finder.exe

.exe 10.1MB

X86 Token Finder.rar

SHA256 fa12b97c9b66ebb68c04c9eadd4585f5db9074ca17db85d67b58acb4f1f24261
MD5 c613d85f5bdc6a5a2c1654fa9a3cf910
SHA1 dffabba9331ced91d32a285383f3de9a52cace14
SHA512 d2590458f8f63b2f3cb908a76ef47eea92c78fd086da6084da1acfa4c0cac288c68d42b006f9080e46ce830386781090207d949443b09ccaf6fe3ee7f33bd23d
SSDEEP 196608:PBVAzVVlnMoOlRsOxmFU3MMrRmkN1xhGSUnmTI9RFJ1YguNN:PBVsV7MoOlRVo+MMFmkSSUmTk9b2
TLSH
T140B6334B7AA653BD61CBDA4E1C8035B8FDACC81307D25F44434B9201B9C67EF667A728
MD5 SHA1 SHA512 SSDEEP TLSH

Password

sino

X86 Token Finder.exe

SHA256 42f8d650982905a593335f6d57d452240d1400539d0fb8e863d0ccf1382dbd02
MD5 3705ea76e278333caef68a4bed68a0c7
SHA1 e741ca47d319013f08620123ea73bca51df321b4
SHA512 ec74280bee505c745ff21cfc475f6830cc85346f8057c2fecf82276cd03e0c55abed7ce3acf1d2dacb08f9f3b403c121c4e13bc905122ea2acf5066cef1824e9
SSDEEP 196608:+eUJmswlCoaoVatprmwgecw8oQzFfTGEh6yTTdtwdm:yW5gvgt4QzBSEh6yTTdtw
TLSH
T15BB63378A8124F7BC22FD3B5F8709C296CE6E39904574A7995AB738763C3C6344A5C38
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Password

sino

Minor OS version

Major OS version

Entry point

12214360

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

Size

1024B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

7.5MB

Virtual Size

7.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

512B

Virtual Size

744B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

X86 Token Finder.rar

X86 Token Finder.exe

generic