7f67450b976349eae6c52394643d22f4 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

7f67450b976349eae6c52394643d22f4
Size

5.1MB
MD5

7f67450b976349eae6c52394643d22f4
SHA1

8d86b7fda74a0fa1202012a749dd6e0b48525d67
SHA256

6bfabd7aa9f18690bd6e4bfea2e1884d3ee98dfbd50be2a703a0e0247b1d9e14
SHA512

fefe04efb557b148382913463208c021ed993029fe857ff5f815b1b4f280cc0d67c5adf39192be082299c42f49b0107225fefcc216072fbade64c1e83f6a2bd4
SSDEEP

98304:pGDZphpTpotE06ksl8AJ91QxwZZiN/AGFasxoXxYR5XuDCDsjOu3tmOpJJuxs:QoCr8AHZiN4I8X4ZuDFOuD

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7f67450b976349eae6c52394643d22f4

Files

7f67450b976349eae6c52394643d22f4
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 45KB - Virtual size: 112KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 577B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 15B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.imports
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 8.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 5.1MB - Virtual size: 5.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ