f3937875e6e85406d8b75dead927905ba7d7d51b3ed2703cafd06ce3368fdb0f | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f3937875e6e85406d8b75dead927905ba7d7d51b3ed2703cafd06ce3368fdb0f
Size

4.9MB
MD5

e2009a304cd3d94a0f6f450b14c5de71
SHA1

92701ac9b829a71ba9c42fa30e532453df86bb3f
SHA256

f3937875e6e85406d8b75dead927905ba7d7d51b3ed2703cafd06ce3368fdb0f
SHA512

2b90859e20d34f6c6f463921987f4b7a57b249966ed8d379eb16f637431451fd06e8f32e6975b249a3856ed025953f9409d04a766d1891db3afcce7d3e5e0c16
SSDEEP

98304:/Ns5jay2cFqjcC9id3qaCo7lNRDmrji0+9f2gdGnVifufMSYaudRilZ+46o7s:/6jaMIjcHVDKE9f2jffMSY9ildJg

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Files

f3937875e6e85406d8b75dead927905ba7d7d51b3ed2703cafd06ce3368fdb0f
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 7KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Themida
Size: 556KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE