1324b2413dff467b690943c695a54852 | Triage

Sharing

General

Target

1324b2413dff467b690943c695a54852
Size

2.1MB
MD5

1324b2413dff467b690943c695a54852
SHA1

4438365bb523a3d964b36596198197d0b2b2cb65
SHA256

79a19760859ed5d753fd5a3690390773be75406b137eae99d072fde776ce4d74
SHA512

2b404e8c5ce58648739eb02a3e8142575bff0c936ce58c4c352fdbcfdab1142fbd49f28e581d697bfc1c83eb0e79cdc35b16b03fe228a77445ace28f0b739eb6
SSDEEP

49152:qeMwVGCjidoB16EwMEgPq6AQ63RmndfaC9tCvja:qeMk6oBpwM5y6NndC

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1324b2413dff467b690943c695a54852

Files

1324b2413dff467b690943c695a54852
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

Size: 720KB - Virtual size: 720KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

mmym
Size: 22B - Virtual size: 22B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Themida
Size: 1.3MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE