4620569e4c532098f69ff34061dbcc70179199514bb6aa198c8c5feb85c16424[.]zip

General

Target

4620569e4c532098f69ff34061dbcc70179199514bb6aa198c8c5feb85c16424.zip
Size

2.1MB
MD5

36bcc4ae91cbd2fc084c1cbc11972833
SHA1

5517d7e55d1aa3f0531414cd29ea286125ba522f
SHA256

86c685b994308219175a77c12ce12c2ff0bd4f8b0ddd1c3584037bbca9f61d8a
SHA512

1225f5bca8a2125d7d25496265bee34af3dca04321a1dd903fa4bb35a2326823a263d8d87dfada57800563cb91cd300fabe744fee1e34b5a553d0de591059a86
SSDEEP

49152:PQMqWf7sYh6ecjbxEU1zfb6dHuBAzCIaB:4Mvf4Y3cL16NuBX

Score

7^/10

themida

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
static1/unpack001/4620569e4c532098f69ff34061dbcc70179199514bb6aa198c8c5feb85c16424	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/4620569e4c532098f69ff34061dbcc70179199514bb6aa198c8c5feb85c16424

4620569e4c532098f69ff34061dbcc70179199514bb6aa198c8c5feb85c16424.zip
.zip

Password: infected
4620569e4c532098f69ff34061dbcc70179199514bb6aa198c8c5feb85c16424
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Size: 74KB - Virtual size: 136KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 249KB - Virtual size: 248KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.themida
Size: - Virtual size: 3.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ