86845baf78cb76ee6be5d29880e28389f7cace83b69d547f5393477779051ca9 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

86845baf78cb76ee6be5d29880e28389f7cace83b69d547f5393477779051ca9
Size

2.5MB
MD5

5b11f190764173c72740ee06cefd0183
SHA1

e224906ac73e49ff5576945f46ba89d608cd04cc
SHA256

86845baf78cb76ee6be5d29880e28389f7cace83b69d547f5393477779051ca9
SHA512

9e80bfec5473dece3c593cbd14ebc9ac92564c22aa6ed36fc148c510ad5348362f2bb48fbb94e61ce1f572ad6684cfa83c4bdc6a034cc38ca9db2f6dbce3eed4
SSDEEP

49152:ZI+yKNB/punJstf/prP8ts1qs/UgxwNJX4kq3RIzyfh4YYreQJ:ZI+7PxuJIHpwtsw+kN5GRIOhm

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Files

86845baf78cb76ee6be5d29880e28389f7cace83b69d547f5393477779051ca9
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

Size: 339KB - Virtual size: 824KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.3MB - Virtual size: 19.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Themida
Size: 888KB - Virtual size: 896KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE