1571b2ee13c7552f19b2fffc1c3f7dc63dffa8652d0cfa32136852629763018d | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1571b2ee13c7552f19b2fffc1c3f7dc63dffa8652d0cfa32136852629763018d
Size

8.7MB
MD5

26b47b54536e9c45a5d8e9f9141b9859
SHA1

b2f7888d7cad8cdf8ec088beed2016aa25543439
SHA256

1571b2ee13c7552f19b2fffc1c3f7dc63dffa8652d0cfa32136852629763018d
SHA512

5fcb436b7d154fda8179ce820304ccd9ccbdb9097c000b0e8f4d71eb1e581d4363b12ca659445dca788683c5215e6ea2714bfed00cd48f8911012e9feaf04a06
SSDEEP

196608:XCgxwmPpoCtterxviicZWmIpUfI6UQHRYajrUYkg:X3xdNtte9viiQWnpUfIDQHRYaXUYkg

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Files

1571b2ee13c7552f19b2fffc1c3f7dc63dffa8652d0cfa32136852629763018d
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 335KB - Virtual size: 629KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 30KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 4KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 6.1MB - Virtual size: 6.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 3.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ