31a08ca796d81aad72c8d8f52598f891 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

31a08ca796d81aad72c8d8f52598f891
Size

5.1MB
MD5

31a08ca796d81aad72c8d8f52598f891
SHA1

2d4b3b246e01134c2d689d7d56b8b537a5599438
SHA256

cc357e770bb13aec3774cdc2d99ab2588a37e36dac27e0f237cc5c8bd444da8d
SHA512

d5cba0071485c1bd006e1f7e27ed3a9fabf2026a12d1389aa2b706bd8a6a531983724e1972fdde577f59116cd14584c9393b0b7355d6e4c697eb0b4ad0de554d
SSDEEP

98304:dZOKkDMWPTKIWGSnNZa7T4BU9JvHYmcz05x/O63u:IRrKIH7TvHrJ55e

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
31a08ca796d81aad72c8d8f52598f891

Files

31a08ca796d81aad72c8d8f52598f891
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Size: 13KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.imports
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.themida
Size: 5.1MB - Virtual size: 5.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE