0642a53a2637e96c30f3ac320ff392f5 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0642a53a2637e96c30f3ac320ff392f5
Size

4.9MB
MD5

0642a53a2637e96c30f3ac320ff392f5
SHA1

2f687768fdb23c19fa3dfb014445400aeb40c9a7
SHA256

2cab45687479fed45bcf902ee0b278885ed762a3936b06d54347a8f3cd93ce3d
SHA512

36109afd140fde90f344871d0a1979fc4110371f7b77a4907385ddf132245022c99f1420c16f9f0179e69a25b8720f89c833cffe841d1cfcef51397320fe5b46
SSDEEP

98304:RmKooluglFG53vBczEtO60phk9oIXXY7teqXieIkpcPEs72ZF+4bRaab/g:R2Wzmz97YMUAEbhV1b/g

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0642a53a2637e96c30f3ac320ff392f5

Files

0642a53a2637e96c30f3ac320ff392f5
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 232KB - Virtual size: 504KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.imports
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.themida
Size: 4.7MB - Virtual size: 4.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.taggant
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ