49cb6f8eee416dda1684578d32a4dc35adac13fccd779e545a9c4f034056ff96 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

49cb6f8eee416dda1684578d32a4dc35adac13fccd779e545a9c4f034056ff96
Size

601KB
MD5

82000c260da3c09fe4a78d2f56d8a490
SHA1

d304c98d809e596de8c63bcd875c3654a3b4e8d3
SHA256

49cb6f8eee416dda1684578d32a4dc35adac13fccd779e545a9c4f034056ff96
SHA512

5fe27f30b4cb0fb206202dd145032a3427354b358bae51879ee3be6c811afa0ab73169e19a785d2a999de1eddc0da56435214f12f5614814e772d93b99babe5e
SSDEEP

12288:ZmGgruSrvqyaAgzwV2BklQg2PnQCZipF+UOYVltIqa4+4StXJg4HaZ:Er1rC9kVy1vtZA0UOktn+5g4HaZ

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Files

49cb6f8eee416dda1684578d32a4dc35adac13fccd779e545a9c4f034056ff96
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

Size: 3KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Themida
Size: 586KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE