c1d0b2c516e0ccd591338611ec76efb6c26ba1731de37c50c7c443bdb027c2a2 | Triage

Sharing

General

Target

c1d0b2c516e0ccd591338611ec76efb6c26ba1731de37c50c7c443bdb027c2a2
Size

5.7MB
MD5

9ca968e7fe7c40a6324e047ccca6a7d6
SHA1

c48a0f1bbcf242e50b5239c72bfcd32dd64eaad7
SHA256

c1d0b2c516e0ccd591338611ec76efb6c26ba1731de37c50c7c443bdb027c2a2
SHA512

9e33e3584dacc531516bb98ead6a151c250c82f3518d2b3c44347ed2fee2f99285457f9a1d8752bc06ea48dfee267a07a4ce834d7155766352930bcc65c34b98
SSDEEP

98304:ZTEWU8jUj8sS/MZIZPP0G/tY1QWDIJbjRH5ux9fgAfBmRGUU3CF/5NCDNxX5EGVE:pUlIsGMZEP8G/tmQGyjRUx9hBmUeIFC1

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs
Detects Themida, an advanced Windows software protection system.
themida

Processes:

resource yara_rule

sample themida

Files

c1d0b2c516e0ccd591338611ec76efb6c26ba1731de37c50c7c443bdb027c2a2
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 2.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 757B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 15B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.imports
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 5.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 3.6MB - Virtual size: 3.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ