faa2000db8db27de75f4ae9d0d7aa182d6466cb08d998c59e0c0756ca855381c | Triage

Sharing

General

Target

faa2000db8db27de75f4ae9d0d7aa182d6466cb08d998c59e0c0756ca855381c
Size

37.6MB
MD5

7581fb2cc81fca45413a91300d7950aa
SHA1

34f52d5a0265cd590dc836200afa2351e86a9d83
SHA256

faa2000db8db27de75f4ae9d0d7aa182d6466cb08d998c59e0c0756ca855381c
SHA512

71d7f94a48a9a41a2cd4cc51c8b0f30dde3ebcbc6f66b7f9d72e705e0aeb84d001b92efb9f3d85e074f5b2740c745a7d4a1fc395175a5c1f1ecd512b0db5ef0d
SSDEEP

786432:1AhYBD8yAKc8pyNkcTUMMlkSyF5CMOIzYL7nPeSV5LuYu25ZPi0:6iD8yByN5akB5CMzzGnPecLTu25Y0

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs
Detects Themida, an advanced Windows software protection system.
themida

Processes:

resource yara_rule

sample themida

Files

faa2000db8db27de75f4ae9d0d7aa182d6466cb08d998c59e0c0756ca855381c
.exe windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Size: 891KB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 184KB - Virtual size: 586KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 23KB - Virtual size: 162KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 75KB - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 2.9MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 213KB - Virtual size: 213KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 9.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 6.1MB - Virtual size: 6.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ