a8620be15d0b2fc6b03c2570864bd3c6 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a8620be15d0b2fc6b03c2570864bd3c6
Size

2.9MB
MD5

a8620be15d0b2fc6b03c2570864bd3c6
SHA1

36e64ad1fb8d9e9e60164affb8f60177e44e7d95
SHA256

e08973689c887132909bef334f713650da5eb255c83b8fa2d79ef4cb6f0c0862
SHA512

e438a298a22a611d3a74ca10fb3f20c6ac90ceb23a1915e1f58c7c2f045d2c1bfa2b0e748fd9e488537bea8aec921c9cff7fabec627814a9db0a32b02668baca
SSDEEP

49152:+ycbFphniUiPyBOi7EfU1eYtD0SAk7xBJME48mCKVxMi+A2wLn9J5qD1lwNwB:DcLOPoyfGaoxBJME4p6EZL9eWU

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a8620be15d0b2fc6b03c2570864bd3c6

Files

a8620be15d0b2fc6b03c2570864bd3c6
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 4KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 654B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 16B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.imports
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 5.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ