f697983c834061ab8dc2219fcfe96e920105210306ebb9f1d14e5cc2f0db96aa | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f697983c834061ab8dc2219fcfe96e920105210306ebb9f1d14e5cc2f0db96aa
Size

1.4MB
MD5

8a945ef37beac85f64cbbad755753237
SHA1

c534314376aeb1e87d27f770a2e259301e511b48
SHA256

f697983c834061ab8dc2219fcfe96e920105210306ebb9f1d14e5cc2f0db96aa
SHA512

ef2256cb45e5bf0fa89878de33993778b481d982635b47ce3419eecca32d4fc5237c24dcf135782031e277926707156a837c979f9c1ab659be5e9645578ac62f
SSDEEP

24576:KPSH97OR7QpMnyq5q3lM0pXgMOzwoVW/L7ufsrW8GVx0gWwee:8wunyCqRq6uEUTee

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Files

f697983c834061ab8dc2219fcfe96e920105210306ebb9f1d14e5cc2f0db96aa
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

Size: 772KB - Virtual size: 772KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Themida
Size: 583KB - Virtual size: 588KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE