file[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

file.exe
Size

5.0MB
MD5

ae2ee76a62c4208b7bfb858cbce6a07e
SHA1

2ddd2a8a9a81a7734d2d548937a5af066df33017
SHA256

31cf1d22c011317d107687c35de88ca6966ee5850978434b34ef2f74d4dec39b
SHA512

97a25abfbb0dd83e8a0d5fec48d29bbc1abe5d2591456d57605dd443bcf8e5a1ed3430225b9158498c163530f75decdf4b07ae297a0a0770a110b20790612cb4
SSDEEP

98304:qUgFeG6RLAfR/GNo7pROqzOYOReXv2aF/XxahNOEWl48BiJ:qUgF11AmpdSYYe/1F/XcrOXxBg

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Files

file.exe
.exe windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Size: 3.8MB - Virtual size: 3.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 138KB - Virtual size: 137KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.themida
Size: - Virtual size: 3.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ