ac527e9d3ab433b98bdb257fc44894b5003f4ba353d1823aeaf4b9844228a6ee | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ac527e9d3ab433b98bdb257fc44894b5003f4ba353d1823aeaf4b9844228a6ee
Size

1.1MB
MD5

6e39d8cfc1ec035509d4459f3d1d73a7
SHA1

900daea41e126537b495aedb5fc8f2ec9b25a072
SHA256

ac527e9d3ab433b98bdb257fc44894b5003f4ba353d1823aeaf4b9844228a6ee
SHA512

030b8a2ac860e642791f4d412f789c374ff22d4b89f7878eb9d2a62934f10a9644dd413558454329b2e519c5b461e2e74e27e79774ed9cb3ff88a577aa5e228f
SSDEEP

24576:8M4FGU+4KuCiBbmfGPkbN/rYzlM2xOJC44YcmfQSYpIsG3tXo6NlB:8M4F9HC+K+QqJf44Vm4S1T91NlB

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Files

ac527e9d3ab433b98bdb257fc44894b5003f4ba353d1823aeaf4b9844228a6ee
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

Size: 219KB - Virtual size: 512KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 70KB - Virtual size: 184KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Themida
Size: 958KB - Virtual size: 964KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE