fa6656648ec34730781b397fdcfed401 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fa6656648ec34730781b397fdcfed401
Size

2.9MB
MD5

fa6656648ec34730781b397fdcfed401
SHA1

2ba0000470fb35c72766926a0ed199004c288952
SHA256

6b11f1f0523cc320e81e9121de53876f4f4f2e11b5f357d122095c87161ef88b
SHA512

033f62ccf133edd376e0ce091c2442f361ed3a5142128194131161b0011dfb5dd94718c0430cca2c2d2fb7ad2796e7143fdcc759818ccea17ba5238fb09c05ca
SSDEEP

49152:0eBkEiVCgZGyvgvH2pLm3p7MqOZ6/2+2Et6TRjc0S2MgqevkKiPhVFBW0xt32n15:LvexpLm3LJxt6VjrSeMbnHW0X3Wh

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fa6656648ec34730781b397fdcfed401

Files

fa6656648ec34730781b397fdcfed401
.exe windows:5 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 341KB - Virtual size: 636KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 30KB - Virtual size: 142KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 4KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 97KB - Virtual size: 656KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.imports
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 170KB - Virtual size: 170KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 3.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ