7c0b456326fe0a6972bccbd5d131596804e47fbc67438922e1332a43f05c4c0a[.]exe[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

7c0b456326fe0a6972bccbd5d131596804e47fbc67438922e1332a43f05c4c0a.exe.zip
Size

3.4MB
MD5

fb9c695b2498f932e4c79ad8ee143596
SHA1

cf58658a0f3a292ad95cf635fb798e2c457a67f3
SHA256

6817ab8b63ab95c32e2fdd17b329a5cca29d3a6e1287bb7c3d3c45ebfb078d66
SHA512

d9fb573f9b29502d147b577980cc74b41e54d3a2be57c34445c3def56ce2485c09107d729f5ab65ed12a041da900e95b98bd804cd9c9944a67776cbcee398406
SSDEEP

98304:NfbbgbAoBmZSnFTWGnidIR3L3iAiqcGVgXO7Sz+Opsr:NfnVoA4nFTYmpzPiXGVr7Sz+4sr

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
static1/unpack001/7c0b456326fe0a6972bccbd5d131596804e47fbc67438922e1332a43f05c4c0a.exe	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/7c0b456326fe0a6972bccbd5d131596804e47fbc67438922e1332a43f05c4c0a.exe

Files

7c0b456326fe0a6972bccbd5d131596804e47fbc67438922e1332a43f05c4c0a.exe.zip
.zip

Password: infected
7c0b456326fe0a6972bccbd5d131596804e47fbc67438922e1332a43f05c4c0a.exe
.exe windows:6 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 510KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 49KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 39KB - Virtual size: 219.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 7KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 79KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.idata
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 4.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 16B - Virtual size: 4KB

IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Headers

DLL Characteristics

File Characteristics

Sections

Size: 510KB - Virtual size: 1.3MB

Size: 49KB - Virtual size: 130KB

Size: 39KB - Virtual size: 219.9MB

Size: 512B - Virtual size: 9B

Size: 512B - Virtual size: 88B

Size: 7KB - Virtual size: 14KB

Size: 79KB - Virtual size: 98KB

.idata Size: 1KB - Virtual size: 4KB

.tls Size: 512B - Virtual size: 4KB

.rsrc Size: 2KB - Virtual size: 4KB

.themida Size: - Virtual size: 4.5MB

.boot Size: 2.7MB - Virtual size: 2.7MB

.reloc Size: 16B - Virtual size: 4KB

.idata
Size: 1KB - Virtual size: 4KB

.tls
Size: 512B - Virtual size: 4KB

.rsrc
Size: 2KB - Virtual size: 4KB

.themida
Size: - Virtual size: 4.5MB

.boot
Size: 2.7MB - Virtual size: 2.7MB

.reloc
Size: 16B - Virtual size: 4KB