97d653ebabb14d28710e6c49d5d6c883e3576238a440a328cb872d2fce5a757b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

97d653ebabb14d28710e6c49d5d6c883e3576238a440a328cb872d2fce5a757b
Size

1.3MB
MD5

3e074a269c0e7df07fa006c0239c673e
SHA1

8ed0180ed2f101cbfd01b61893fe865f86106e9e
SHA256

97d653ebabb14d28710e6c49d5d6c883e3576238a440a328cb872d2fce5a757b
SHA512

4e5b7d4d59f7e7a4f25bf29cdef2545a040e37718ef34d091387ba1205da8e187f027a037623d93165d61b1eabf3c31e32acdd7d1e4fb9e3d25383efc17af663
SSDEEP

24576:aDnxhTE6RUnYER/pocn9Wc95OFl4Y+9jF2cqBFg3cIx5XUAAPeKMPaLg/3NjnG22:aDhUntnn2mP27BMcYUAAOlGWs

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Files

97d653ebabb14d28710e6c49d5d6c883e3576238a440a328cb872d2fce5a757b
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

Size: 682KB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 345KB - Virtual size: 842KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Themida
Size: 817KB - Virtual size: 824KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE