b47442e65659b041f71144cfe1e943ac9f3c449b87ab96a73f9aedac4f5db836 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b47442e65659b041f71144cfe1e943ac9f3c449b87ab96a73f9aedac4f5db836
Size

1.5MB
MD5

f77590acf33a21bce4ae045decf95409
SHA1

5d18fd5ed3b63d700c3b260cfe9b412335fc5300
SHA256

b47442e65659b041f71144cfe1e943ac9f3c449b87ab96a73f9aedac4f5db836
SHA512

6cb2df55a17b079c9f85c6ff09f9be0f979c9ab1b5cf1e5e768d862eff101c4df4b23546e3204a2ba60935e35826679e25c97eb473f19b9890e7d50e6ba7941c
SSDEEP

24576:st0NiBjC9TD/hwg909sNkwm60lcAlD03glA3nDXxARgRAcx5AnjQrk0Glq:w0NiF26g4sCIO/0mA3FARgRA+XkJI

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Files

b47442e65659b041f71144cfe1e943ac9f3c449b87ab96a73f9aedac4f5db836
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

Size: 106KB - Virtual size: 248KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 21KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Themida
Size: 638KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE