b602a1744a8fb03f204d4c6f9077e9f6b0aa7491713407e2bfa1fa1fa81d08f1 | Triage

Sharing

General

Target

b602a1744a8fb03f204d4c6f9077e9f6b0aa7491713407e2bfa1fa1fa81d08f1
Size

701KB
MD5

4c47d9ff4785c018c259c54c7078f550
SHA1

e7506dbb61b4de6cc4d72b4fda79fdb10d1c906d
SHA256

b602a1744a8fb03f204d4c6f9077e9f6b0aa7491713407e2bfa1fa1fa81d08f1
SHA512

bf603dc2116050ed56c0b060abc227e1494163099eea2dc21f8e6d49422ef6ea72678d1f73567583c7f5e953df1ff24ed11c5b0c3e7ca9296244e71a87d90542
SSDEEP

12288:Z6JF4VSJaaLoGojSvCslsyI7Khmqp9/C/3SlJsQcXHs/FAtc:d4waoGoPlZnqbC/3ky66c

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Files

b602a1744a8fb03f204d4c6f9077e9f6b0aa7491713407e2bfa1fa1fa81d08f1
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

Size: 72KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Themida
Size: 624KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE