6ad1789f0a8487913f8c08a145d964582e8b32d90741c150c158e3d3a46886f1 | Triage

Sharing

General

Target

6ad1789f0a8487913f8c08a145d964582e8b32d90741c150c158e3d3a46886f1
Size

1.2MB
MD5

cf3c8e47c1df8e2f40439242ae14d23c
SHA1

1dc5666cc570e6a15147ecef1b3ec2f0f736277a
SHA256

6ad1789f0a8487913f8c08a145d964582e8b32d90741c150c158e3d3a46886f1
SHA512

3a10827a14cd0c313e685ae52ae2d479023777d400823fd3516dd4bb7387d8b4459df006c4b07a47623b71165de6ab93b081f9c4fc37d2aff0fbc0f2555267e2
SSDEEP

24576:isbilOzC6FRyp3wL9GtD8Iaywh1UueXUYlWaNlvaUTBejei:iqil4C63CyH1EXjXCUVri

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Files

6ad1789f0a8487913f8c08a145d964582e8b32d90741c150c158e3d3a46886f1
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 78KB - Virtual size: 212KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 111KB - Virtual size: 129KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Themida
Size: 1.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE