6e9466390a610d91acb82b48b25392fa | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6e9466390a610d91acb82b48b25392fa
Size

10KB
MD5

6e9466390a610d91acb82b48b25392fa
SHA1

fd06b72dc4ca8b65b646ef39d9f93d3fae04bc32
SHA256

e5d89268b562a88f6cd63afe3c94f526d6a9c93613e1406952277efb6554f18e
SHA512

91625e9ab488fe4e913ceac1ded8ffc1e12597de4466ba586aab00d18b2e88fd28f0e44c3f6bf5f612b949c4ed13100d6e3ea72186ebb86fcaa878c578f14d04
SSDEEP

192:AoEG5WpzAPigyGjIMGEJPPr7Nacpvw9U+rX:n1KzAFykJPvN13GX

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6e9466390a610d91acb82b48b25392fa

Files

6e9466390a610d91acb82b48b25392fa
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

Size: 36KB - Virtual size: 400KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Themida
Size: 656KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE