0beb6a2de8709462819bb2e6e06ec60d | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0beb6a2de8709462819bb2e6e06ec60d
Size

2.9MB
MD5

0beb6a2de8709462819bb2e6e06ec60d
SHA1

06d5e91b050ce7402f1e86639a4dac763f6de16b
SHA256

8e692fcf5a0eed175abd24584466bf2e955ef5d37b30b9cc23494a146c5e7c07
SHA512

7f677e53b26e32c60582e0e5ba62285cf05eacd2962d958a1be3d3342bbd73b7b7ee3bad48446eed8942f87465c3687c8913c07087d5736c0d00658268c03550
SSDEEP

49152:kJ8w/LgPVj8a0hCQuXznMy5BZDIfIzHVwbZWA5Z7+Ct2KJ0ahQVYUgToZV9hbA54:kWw/89jh0hULZk+VaZFt2KJ0ahQ9gTUj

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0beb6a2de8709462819bb2e6e06ec60d

Files

0beb6a2de8709462819bb2e6e06ec60d
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 45KB - Virtual size: 112KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 581B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 15B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.imports
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 5.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ