dc76572c3e5fab7ad5259ac183c8279562d7d4168644efeab84184b6684d9395 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

dc76572c3e5fab7ad5259ac183c8279562d7d4168644efeab84184b6684d9395
Size

874KB
MD5

6c79aa55d1fae3cc7a0a155c30a07715
SHA1

39b8cfca6f4714e5dcea4d0288bd90c8c799f902
SHA256

dc76572c3e5fab7ad5259ac183c8279562d7d4168644efeab84184b6684d9395
SHA512

0f8ccc5b017ea445b334cc222c35498fd785213c7cc94b01b823cd1f77ee9716eabfa5a96fde059016afc810067653b4f8c8d8594a85bbd1c5f93bd118b104ea
SSDEEP

24576:F8RB8n9NT+A6FvdbUHihGDKh0LV0+UGMWHivXvTCl4Zj9UXQEcDj:Fjn9NT+A6FvdbUHihWKiVbyXvm+nUXwf

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Files

dc76572c3e5fab7ad5259ac183c8279562d7d4168644efeab84184b6684d9395
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

Size: 212KB - Virtual size: 212KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Themida
Size: 656KB - Virtual size: 660KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE