94d9aab8b2afbd6321cdc1d71cf61e2ca6396d7374221335cc6a7ea7bbae3e04 | Triage

Sharing

General

Target

94d9aab8b2afbd6321cdc1d71cf61e2ca6396d7374221335cc6a7ea7bbae3e04
Size

1.0MB
MD5

ea152391202b4fcef52ec714ae5684bb
SHA1

0646192dd09e55ab2958fb753fc801d1ff293dcc
SHA256

94d9aab8b2afbd6321cdc1d71cf61e2ca6396d7374221335cc6a7ea7bbae3e04
SHA512

0940fb9e270d180d5b1b68b7db15425d20ba314a41da7042b07008312fa98ffbce21c78ca677b22eaea2e4b7b1b58fe9d38aa1483a93ef00cce1f5d9d3d83048
SSDEEP

24576:0cNJP38kXIxRkm0BCRLo50WD15X8ezAMPZWWPItL9wuWm7I1vq53b2:0cTPMkMRp5ORnXyG8tLPWm7aq53b2

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Files

94d9aab8b2afbd6321cdc1d71cf61e2ca6396d7374221335cc6a7ea7bbae3e04
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

Size: 248KB - Virtual size: 248KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Themida
Size: 795KB - Virtual size: 800KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE