b559413c43d76b67e8b068c842a0a615b04d6d687be860e18da1adc43dfe5b5e | Triage

Sharing

General

Target

b559413c43d76b67e8b068c842a0a615b04d6d687be860e18da1adc43dfe5b5e
Size

8.1MB
MD5

e08805d6085d6402dcaeb253e4375a09
SHA1

2c79a1203c135aa1a7d5fbed566c94983278b40c
SHA256

b559413c43d76b67e8b068c842a0a615b04d6d687be860e18da1adc43dfe5b5e
SHA512

517d723f46c11a10eb303d655ffca77b1bc3f863450208e659cfea70276f15a7d921d52c04597d035faebb7278e66ff55bbb45b451568f11bc176650bd149db9
SSDEEP

98304:iFBz9bmxmtOfP7TI/OKIdSOwSmGrjvvLYq5dkcDNckgHDJHZt:qBzQxmtOfzsWKgwS1jvvH5uFHn

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Files

b559413c43d76b67e8b068c842a0a615b04d6d687be860e18da1adc43dfe5b5e
.exe windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.text
Size: 416KB - Virtual size: 416KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 281KB - Virtual size: 281KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.themida
Size: 7.4MB - Virtual size: 7.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE