0f231f40005620b6b74473b8d186fcd4 | Triage

Sharing

General

Target

0f231f40005620b6b74473b8d186fcd4
Size

632KB
MD5

0f231f40005620b6b74473b8d186fcd4
SHA1

e3348ccbdbe5a2d5996e96b04197822b5855c75b
SHA256

4ca3ea16835dce28fd37b5e222f8942b26ef5f07478dabe95fbd2727a573b385
SHA512

090ffa8fde0b650ea233441d8f2eb1afeef3d1dd733fccb436202b533ad45396de4ce370c5717bea11c3ef7881c34d5bc72940f779dacd01d3b645710215041f
SSDEEP

12288:HS1TNAhL1ZvOH00yFXovOSRX6NuxpodZCIMPUOo6GKRu6kWB:ExC1ZvOH/yFXovRB6NuxpodZChdouRc

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0f231f40005620b6b74473b8d186fcd4

Files

0f231f40005620b6b74473b8d186fcd4
.dll windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

Size: 14KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Themida
Size: 612KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE