file[.]exe | Triage

Sharing

General

Target

file.exe
Size

2.1MB
MD5

5ba5f954be0ccebe4b04a2f7d32b5b70
SHA1

40c2e36b7e79d0b676fe90dcc43d0595219885f6
SHA256

d40a01137b266d7416d640caab27ba34517e899aa8d7e53229d8b78067b02a6e
SHA512

ed7daa30bd8fbe5a2b909a8af2c4386bcbd28c84268b18157e6183855d1451a46db1e1f80ab6f2825fa6068dceffc9e98c6cbd13fdff9c21ecfde86bb9637792
SSDEEP

49152:O0hpg74r02Gv8rLcmPYg+z9DgkfMtpPI/LASf7pBOo6bU0FxZ:O0j04rBr4mQFgkfMtikWpUo0L

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Files

file.exe
.exe windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Size: 556KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 254KB - Virtual size: 254KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.themida
Size: - Virtual size: 3.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ