6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0.zip
Size 8.7MB
Sample221130-jt2nbabd83
SHA256 2fd280ab8f9ef860843debfda9842c445df48ead601bb92c611b884a04fea202
MD5 177a868778ea56c79ee409c979e1f276
SHA1 2776d3294be91cc252ed5cbe7d699b24f2e418af
SHA512 f06dd2f7de7cd7e3d4992919eea8ebc8f351ff354c79056532e30a17b2c66085be3791201748a2191451da9e9a6b1119c8f5f011af08c5f8ece6a062787affa8
SSDEEP 196608:wGLkGWgLsspzfYRp/kRtPdjGp8gx9iZJL/c4Q0IVXk4x/A+PRidly5zvj/z:dOAg4zPdip8Sivc4Q0IVXFx/AGyl0vf
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
static1/unpack001/6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0.exe	themida

File Explorer

6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0.zip

.zip 8.7MB
6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0.exe

.exe 8.7MB

6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0.zip

SHA256 2fd280ab8f9ef860843debfda9842c445df48ead601bb92c611b884a04fea202
MD5 177a868778ea56c79ee409c979e1f276
SHA1 2776d3294be91cc252ed5cbe7d699b24f2e418af
SHA512 f06dd2f7de7cd7e3d4992919eea8ebc8f351ff354c79056532e30a17b2c66085be3791201748a2191451da9e9a6b1119c8f5f011af08c5f8ece6a062787affa8
SSDEEP 196608:wGLkGWgLsspzfYRp/kRtPdjGp8gx9iZJL/c4Q0IVXk4x/A+PRidly5zvj/z:dOAg4zPdip8Sivc4Q0IVXFx/AGyl0vf
MD5 SHA1 SHA512 SSDEEP

Password

infected

6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0.exe

SHA256 6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0
MD5 2f56038a57495ab5608e1c67f7dbd688
SHA1 4da970efac6083ea26971c319671bcc2d6efd71a
SHA512 12f1774ce6371fe1bcbee92107c46823694416e98068083e4d38c5a3381a4ca07b6d0895c6c09fb1c590fc20d9ed1e9928cedb6e0608a91c3addb4c9eee7520a
SSDEEP 196608:dDUIKAOLfrO/vgf8s3YLo71iEHj9kZVz/RV:dAIKRjrO/aILU1J9kx
MD5 SHA1 SHA512 SSDEEP

windows x86

Themida packer

Detects Themida, an advanced Windows software protection system.

themida

Password

infected

Minor OS version

Major OS version

Entry point

11264616

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

Size

335KB

Virtual Size

629KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

30KB

Virtual Size

140KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

4KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

5.8MB

Virtual Size

5.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ