95d3675c4f23be1a72fd1fc1af29d63de6cc3beb2dc62ee572af92808b125c27 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

95d3675c4f23be1a72fd1fc1af29d63de6cc3beb2dc62ee572af92808b125c27
Size

606KB
MD5

9a0e314288aecb6060832f0059b0f947
SHA1

41eef0b084610a78b383e3debf4261080d6e4d7f
SHA256

95d3675c4f23be1a72fd1fc1af29d63de6cc3beb2dc62ee572af92808b125c27
SHA512

2888a0d8e55d99f5a2a7739384f4899d44232069de6eb893e9155cc1a20b8bca86fca3e556f9fc74f6effc268c58c4b3dcf0347032a614424e1ea1806ba7dd6a
SSDEEP

12288:8MduiA85U214kdXzuCiwUbSfUEJv8VCyrPkbN22S3sYzlpuhH:8M4FGU+4KuCiBbmfGPkbN/rYzlM

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Files

95d3675c4f23be1a72fd1fc1af29d63de6cc3beb2dc62ee572af92808b125c27
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

Size: 219KB - Virtual size: 512KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 70KB - Virtual size: 184KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Themida
Size: 958KB - Virtual size: 964KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE