a0f646b6753d17feb282cdda6e4d64330fafc1a387f92170bbc1c8af70382eee | Triage

Sharing

General

Target

a0f646b6753d17feb282cdda6e4d64330fafc1a387f92170bbc1c8af70382eee
Size

4.9MB
MD5

304d155cb9f0d98221bec7528a3c375d
SHA1

7b563431c1c4ced1a38ee5412e172d32730237a3
SHA256

a0f646b6753d17feb282cdda6e4d64330fafc1a387f92170bbc1c8af70382eee
SHA512

31d28a9de159bdd2b1e9e224afecf472ccca81dc508a6f8b92163fbc5d257ac370f4bf91f591515123bc76a986c8e623f9346817c1c88218982ac2beb8b68706
SSDEEP

98304:fNvAZTyDoqlhjJvd1Yp281fl00iKXP9RWEa+1q9C6Qp3wwf5gI:1vCODf9vdWp229pdXPWW1p3wYg

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a0f646b6753d17feb282cdda6e4d64330fafc1a387f92170bbc1c8af70382eee

Files

a0f646b6753d17feb282cdda6e4d64330fafc1a387f92170bbc1c8af70382eee
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 24KB - Virtual size: 67KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 32KB - Virtual size: 117KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 6.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 4.9MB - Virtual size: 4.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ