c20210806897d795d5455c8b55a50b2ddeb68b427ddb247a851d1488f1db3f0d | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c20210806897d795d5455c8b55a50b2ddeb68b427ddb247a851d1488f1db3f0d
Size

961KB
MD5

6302b8ab00fbd51d8905099db63af47e
SHA1

fd896f67b34233e59a13725b00b096f22578f9cb
SHA256

c20210806897d795d5455c8b55a50b2ddeb68b427ddb247a851d1488f1db3f0d
SHA512

0399e829fc809d27cb3c394e8866afa2e5ae3e529783e09ec5bec08e63f0e4bc24246347e7110538c699467c240700f6e864245436d87656913badbb841cd170
SSDEEP

24576:WFESIzZDd3qC9y52h2+1cwsXSVyXTppxm:yA3pjjGiV

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Files

c20210806897d795d5455c8b55a50b2ddeb68b427ddb247a851d1488f1db3f0d
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 22KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 284KB - Virtual size: 294KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Themida
Size: 650KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE