d7c861ca408fb59681fed422f80a08d3524d4673d467bd97b9d67e38f2a4808c | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d7c861ca408fb59681fed422f80a08d3524d4673d467bd97b9d67e38f2a4808c
Size

398KB
MD5

5ab7ef6c82836408b2ee6e35287fc630
SHA1

04b4aeda120e86c5f387b520d8e3082577522846
SHA256

d7c861ca408fb59681fed422f80a08d3524d4673d467bd97b9d67e38f2a4808c
SHA512

4bc36e6e03023f87831d93d3477ec6dddef29910a5a29148de1e221868f5a62befb1008f5d6cf7c5c190b411d238720573b01a62413d19e941fe1fb3c9fc1b9d
SSDEEP

12288:8MduiA85U214kdXzuCiwUbSfUEJv8VCyrPkbNF:8M4FGU+4KuCiBbmfGPkbNF

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Files

d7c861ca408fb59681fed422f80a08d3524d4673d467bd97b9d67e38f2a4808c
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

Size: 219KB - Virtual size: 512KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 70KB - Virtual size: 184KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Themida
Size: 958KB - Virtual size: 964KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE