43c3d24199fbe1a66f24e82be9741dfcc27147a5489bdeff2944032521b27beb | Triage

Sharing

General

Target

43c3d24199fbe1a66f24e82be9741dfcc27147a5489bdeff2944032521b27beb
Size

3.2MB
MD5

89af4403511aab4d34ec8f22e0a8a5a3
SHA1

9de3ea6ac72b491a85ab7ba1150cf9941c99cd0f
SHA256

43c3d24199fbe1a66f24e82be9741dfcc27147a5489bdeff2944032521b27beb
SHA512

e5700a2826983c5f4681eeb67db95e8cb4ca2b7fe55dcbd9e6211b4a0b9e1ddce30377d8d7f59539ce5d566e264ef851f894f35ef18fd50679c7fdcfc5bdc14a
SSDEEP

98304:nhTfNIGT4kS0xNpq6oPhF64q18U37yunit:hTfNI5k9GM4MLKt

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs
Detects Themida, an advanced Windows software protection system.
themida

Processes:

resource yara_rule

sample themida

Files

43c3d24199fbe1a66f24e82be9741dfcc27147a5489bdeff2944032521b27beb
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 10KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 16B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.imports
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 5.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 3.2MB - Virtual size: 3.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ