784f0cb539e58bfb2a62515760b0e891f4642badc2c437f620a1ab8b652396e3 | Triage

Sharing

General

Target

784f0cb539e58bfb2a62515760b0e891f4642badc2c437f620a1ab8b652396e3
Size

463KB
MD5

7456a06107dfe2bdfde25a98c4a166d9
SHA1

2406e62884fa0d8f690a565afd274e7d2dc84ec7
SHA256

784f0cb539e58bfb2a62515760b0e891f4642badc2c437f620a1ab8b652396e3
SHA512

e4c0cd9ac941eed050f9f8ded8eba1bf014ba84930b4af8f95a6d923bdc4654657994dcd1a9d279a110239501e259ea24801170c8cbc3dc8019aa501b894b698
SSDEEP

12288:xQEJIkuhpkvBOOvfr+bQXzB0qFTQnFGfhV:xQszuhp2BlSbgWrKn

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Files

784f0cb539e58bfb2a62515760b0e891f4642badc2c437f620a1ab8b652396e3
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 4KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Themida
Size: 647KB - Virtual size: 652KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.jgd
Size: - Virtual size: 1B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE