JC_f480cd4b2542c5217014de7a3f2f012e636f23b36c8702d4c6644b1c68cce585 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

JC_f480cd4b2542c5217014de7a3f2f012e636f23b36c8702d4c6644b1c68cce585
Size

6.3MB
MD5

dd1141cf2cc00bb59876e11d0d92a584
SHA1

03cc8991d38e6f2a1a94de4ac16c4db0de6ce75d
SHA256

f480cd4b2542c5217014de7a3f2f012e636f23b36c8702d4c6644b1c68cce585
SHA512

5aa271bfa429b31d493e7d6a9eb9fbc1a1e34f1ab02f87c43bd6c97aa8b1004caddf62d539a64421c8324b442d76a90d1ff462c39baaf7b4e128e0d192486a9d
SSDEEP

98304:nJEkLABoiqFMLNxXibmZEndg/GDlVVhQ28YL9Ijz4g0Z8RkDaCj0N28VzgJ7iEhQ:JEkLABzNxXibTnhDfuwmiaQ0NtgdiE

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JC_f480cd4b2542c5217014de7a3f2f012e636f23b36c8702d4c6644b1c68cce585

Files

JC_f480cd4b2542c5217014de7a3f2f012e636f23b36c8702d4c6644b1c68cce585
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 15KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 10.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 6.3MB - Virtual size: 6.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ