98b6569d916b38313565ec8ff3027588962011cb51f65f7522b99eabf71adfb1 | Triage

Sharing

General

Target

98b6569d916b38313565ec8ff3027588962011cb51f65f7522b99eabf71adfb1
Size

1.7MB
MD5

dc013a5870c13a29d78a5e40b5a09dc8
SHA1

5bf4fe42f87ceb3f331585f498c5d9624c819477
SHA256

98b6569d916b38313565ec8ff3027588962011cb51f65f7522b99eabf71adfb1
SHA512

ac65f3e365d3639ec008fd628bacdd0f1ef261892e156893a970077543e110d9c89f6f1585dcc6294048ea44f00ff653483293a8142bf6be965f7a8a2f86af56
SSDEEP

49152:WsCCkXKskAFO+rlUUiVzd2J7xBMsqDwKU8gqSuB9UFyp2/:WRVXDRZUr2J1RqE98N9UC2

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Files

98b6569d916b38313565ec8ff3027588962011cb51f65f7522b99eabf71adfb1
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

Size: 365KB - Virtual size: 808KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 814KB - Virtual size: 758KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Themida
Size: 604KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE