d3badcdeffc03ff8e0811e3ace5d327d57f4710e8e009d61723cddfd1209e969 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d3badcdeffc03ff8e0811e3ace5d327d57f4710e8e009d61723cddfd1209e969
Size

4.7MB
MD5

ed0424b040b603a94fc74018190ec78d
SHA1

8a38d07baed78c089ee63f0da973b1362ebe8e7e
SHA256

d3badcdeffc03ff8e0811e3ace5d327d57f4710e8e009d61723cddfd1209e969
SHA512

2b4be28cb8dbe77e0283099ef85e1917823f7ee6069fdadf5d2acdcef737f48d8f601f3bfc2a342175c0d38d64d0ff26cb97c86cf194a6a714cf0654acaa0462
SSDEEP

98304:pirpcRqOJSQt04ayS7/mPbmfxzMu7aJL4bSpZibg:MraqOJT04A/mPgt4NgSpig

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Files

d3badcdeffc03ff8e0811e3ace5d327d57f4710e8e009d61723cddfd1209e969
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

Size: 423KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.7MB - Virtual size: 25.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Themida
Size: 583KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE