9470395d5fddad2b8cc018b68d3be69138d130d82242647d0c1e69d70c3419f1 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

9470395d5fddad2b8cc018b68d3be69138d130d82242647d0c1e69d70c3419f1
Size

625KB
MD5

c8e73f7682fcf75a5f29b963e4b73e14
SHA1

80c375de97cc5f55e901b7d1fe521e53529939d5
SHA256

9470395d5fddad2b8cc018b68d3be69138d130d82242647d0c1e69d70c3419f1
SHA512

242c061fd37821c8e5ce68ac408cdcd9ec0f312c2febf4b3a0d216310434b364ea2cbf7ed00496efd362739376b3823a81b97888188b49514c45e989a23bf312
SSDEEP

12288:opr0l2rckdIu9pUGvJv6htVOciL+XOAUAjRQUpQxeyryOKEcCYv:UrA2rckdHPU46hevqOLGusQxfrPLYv

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Files

9470395d5fddad2b8cc018b68d3be69138d130d82242647d0c1e69d70c3419f1
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

Size: 13KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 57KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Themida
Size: 550KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE