f5c03eccca94d9f051fff0d6da06dd28b7e1eaf848fe232f988c7596c3a6dc0a | Triage

Sharing

General

Target

f5c03eccca94d9f051fff0d6da06dd28b7e1eaf848fe232f988c7596c3a6dc0a
Size

7.8MB
MD5

86ada677cdf61bab2a65a967abc92d7a
SHA1

05c0281554ac1d9be1d44a7570ac563ac9f979f5
SHA256

f5c03eccca94d9f051fff0d6da06dd28b7e1eaf848fe232f988c7596c3a6dc0a
SHA512

7ba0e4ca5e504b64ab380c7f663c1d5d8a0827986c53c7f0c555c3a5608ce4e480c883c9e3519d00fbd988081f8306d672c25f3e3201cc2e65d12f0eb7d0f6bc
SSDEEP

196608:e5Gf76iTuX5Jh2o2wz3/LIykpFLZ4TeNljz9:e5C3up6Dyjv4Z4TeZ

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f5c03eccca94d9f051fff0d6da06dd28b7e1eaf848fe232f988c7596c3a6dc0a

Files

f5c03eccca94d9f051fff0d6da06dd28b7e1eaf848fe232f988c7596c3a6dc0a
.exe windows:4 windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 610KB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 2.0MB - Virtual size: 3.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 31KB - Virtual size: 431KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 9KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.imports
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 7.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 5.2MB - Virtual size: 5.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ