367bc0a7c04f553518d060b4a121b9436b5af4a08de5d4df0dfcfde18c124900 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

367bc0a7c04f553518d060b4a121b9436b5af4a08de5d4df0dfcfde18c124900
Size

4.0MB
MD5

b7b95a955cb12538953892152efe071f
SHA1

d5ddb8cd7c34c925ec97357bdb146d46fdb0e4b3
SHA256

367bc0a7c04f553518d060b4a121b9436b5af4a08de5d4df0dfcfde18c124900
SHA512

ee41ebb4f8064f741361c357bdeecd61d87c122e4b3b314ce42e289e6ea6bd8bfa193bb626165a2abfcdee8cfb8e39d2266225dda630de38fb089c1c21c379e9
SSDEEP

49152:1KHIXyWPW1xKzWIkS4X0fjrY7uUNiZqovh4Nkepc5pC7FW/M8C9yylJ/qBlD:Pyx1LW5jrY7zcZqtNke+WSCgylJiz

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Files

367bc0a7c04f553518d060b4a121b9436b5af4a08de5d4df0dfcfde18c124900
.exe windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.text
Size: 482KB - Virtual size: 482KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 425KB - Virtual size: 425KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 840B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.idata
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.themida
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 16B - Virtual size: 4KB

IMAGE_SCN_MEM_READ