317deaad8bda4e938e53ca4d6fffed3c | Triage

Sharing

Copy URL Twitter E-mail

General

Target

317deaad8bda4e938e53ca4d6fffed3c
Size

4.9MB
MD5

317deaad8bda4e938e53ca4d6fffed3c
SHA1

a048b1f5a3ff3ee86b521cc16815307122831887
SHA256

e1aab87a7b672012128f9aab5b8d92ef4cb398c9f9cbfd47f495a43351dd57c4
SHA512

d65bffe0fa3ce1d4bd4d0b260250296140d4975ebaac33b4e9379bdc286a881980cdff0c08b8b32ad21a217cb3c5c88f667798352783dfc8c3888a72f70a92c8
SSDEEP

98304:DxpYAX9fFebzBqGxtBCWqjgJ+Jca50d8XzW8MvUhq9ca:DXg8GDj0HDDJVhYca

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
317deaad8bda4e938e53ca4d6fffed3c

Files

317deaad8bda4e938e53ca4d6fffed3c
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Size: 13KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.imports
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.themida
Size: 4.9MB - Virtual size: 4.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE