3adf25504407ad3d231f01d75a5b1f2f | Triage

Sharing

General

Target

3adf25504407ad3d231f01d75a5b1f2f
Size

2.7MB
MD5

3adf25504407ad3d231f01d75a5b1f2f
SHA1

50b73206c4f64d81e1584a9b05d4697ef0475e3c
SHA256

e0d2e51572c3922fc0fed14c780e9bc551496c9dc370eaed326282e9bd94ee1a
SHA512

a52dcb332c524a0b3619fc579c31889d1f3b72f1a6a2998661642dfad8c5f452feeb43140b3cc586d5cf314979a85501a5ca2273c17027497e7c1a2f9ae9aef4
SSDEEP

49152:5Opw163jF4yxrzSKonAjXrmKQypjHWT7clloCBAYm7wh7gU95oOtQ6d61s5g805M:5Opw6jF7xfnjHWTOfy37wBgU3oOS6dbN

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3adf25504407ad3d231f01d75a5b1f2f

Files

3adf25504407ad3d231f01d75a5b1f2f
.exe .ps1 windows:4 windows x86 arch:x86 polyglot

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

Size: 396KB - Virtual size: 972KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4.8MB - Virtual size: 21.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Themida
Size: 628KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE