4b7c3ad91b0d5400eb3933dcbab339d9 | Triage

Sharing

General

Target

4b7c3ad91b0d5400eb3933dcbab339d9
Size

4.6MB
MD5

4b7c3ad91b0d5400eb3933dcbab339d9
SHA1

492b598e46a11c947f5f8c8f6fff12094117c8a0
SHA256

1e63813a98e15851ad6ffcdc86cb0fcf48c87d77fc03d9f6ec7b5405b19b8068
SHA512

e9669a43826df8e4240f55a33dc36faa5d8374d7f775e39640c92d3d1bf88281ab99a2a185f6e4854f6d82c040a45a39247dc235b87d4b026663b77dff3f8680
SSDEEP

98304:bvxdTW6THGteOyMXw8iLbyCkK3BNE5NMsIYHRv8OMMV:fW5twMXwzy0xNE5NTmg

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4b7c3ad91b0d5400eb3933dcbab339d9

Files

4b7c3ad91b0d5400eb3933dcbab339d9
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 45KB - Virtual size: 112KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 581B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 15B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.imports
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 8.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 4.5MB - Virtual size: 4.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ