b3ad81ab3271ceb36fd1a0266744fecc47246521c25001b83306800033629bda | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b3ad81ab3271ceb36fd1a0266744fecc47246521c25001b83306800033629bda
Size

958KB
MD5

c7f023cc8bc421f3f25ace7c9a6bd015
SHA1

6735354b8613b5dbf9100e1ce29bb13e02ea719d
SHA256

b3ad81ab3271ceb36fd1a0266744fecc47246521c25001b83306800033629bda
SHA512

720eeffd87b4b8f1b23ebc7bd7ce043b328e1a0013558a1c0d9be975d172d691d006b3177f062a4d3dab9bd7334baadb7881af50abddf64ceb63d7207f5c6745
SSDEEP

24576:k/hABj5kZnw9WQLqiPThO/nnKitHkPiyro:k/geZnwvLqiPTheKidkqY

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Files

b3ad81ab3271ceb36fd1a0266744fecc47246521c25001b83306800033629bda
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

Size: 318KB - Virtual size: 724KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Themida
Size: 623KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE