1142abd14a0730098af329a6bb829b243e68e0baed0ed74c16aae75abd7352ab | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1142abd14a0730098af329a6bb829b243e68e0baed0ed74c16aae75abd7352ab
Size

1.1MB
MD5

743dbe2e3850efc1f4957c8d45dc0ff9
SHA1

046495f85cec33aa6cb05a61645249a10142a888
SHA256

1142abd14a0730098af329a6bb829b243e68e0baed0ed74c16aae75abd7352ab
SHA512

37a235171ec7e1d78a1d5a6c92c84f492002e0e35e5ca969ea661689f612fd91ace0159b93ea8abc0e8e265f01174d42e763ce5d5d2cd59ef2fa09793755c791
SSDEEP

24576:Z2IBowWJZ2RTv4xO3RcE7bLS7P5TwAXasf1ASZYXq2QAsjkHn:ZUXZaKe7bUPCAXeSCNL1H

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Files

1142abd14a0730098af329a6bb829b243e68e0baed0ed74c16aae75abd7352ab
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

Size: 299KB - Virtual size: 696KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 37KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Themida
Size: 821KB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE