c3e68aefa507828808c61afdf95cf54c

Sharing

Copy URL Twitter E-mail

General

Target
c3e68aefa507828808c61afdf95cf54c
Size 2.7MB
Sample231220-rkvseaggap
SHA256 57e0e4930aaee4e003e60ae058c6886c9c3ba7674db603378167b50ff76f4840
MD5 c3e68aefa507828808c61afdf95cf54c
SHA1 32d7338d7fc0b45571a278759636b6c3be67bf33
SHA512 f2dd1644fdd1d78486f79c9c870d4c95ef1ec4ec6391bfc83bd5c8dd7946955ddc9a93c07d4e0a5664a6ce398c1f87d9928bd11eb0e48747dab4d3e23093ea67
SSDEEP 49152:qPWgrlC3P28gUcDhyN/8TdNAAz5WKTUAki/YFAStkua5zvh9hixcj9:Td3ODhW/WdOAzRTUAkjFAStkX5zBiKj
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c3e68aefa507828808c61afdf95cf54c

File Explorer

c3e68aefa507828808c61afdf95cf54c

.exe 2.7MB

c3e68aefa507828808c61afdf95cf54c

SHA256 57e0e4930aaee4e003e60ae058c6886c9c3ba7674db603378167b50ff76f4840
MD5 c3e68aefa507828808c61afdf95cf54c
SHA1 32d7338d7fc0b45571a278759636b6c3be67bf33
SHA512 f2dd1644fdd1d78486f79c9c870d4c95ef1ec4ec6391bfc83bd5c8dd7946955ddc9a93c07d4e0a5664a6ce398c1f87d9928bd11eb0e48747dab4d3e23093ea67
SSDEEP 49152:qPWgrlC3P28gUcDhyN/8TdNAAz5WKTUAki/YFAStkua5zvh9hixcj9:Td3ODhW/WdOAzRTUAkjFAStkX5zBiKj
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4608216

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

Size

100KB

Virtual Size

206KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

19KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

1024B

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

7KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.idata

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

c3e68aefa507828808c61afdf95cf54c

generic