15637b571119e1026e585e7e281f62b6 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

15637b571119e1026e585e7e281f62b6
Size

616KB
MD5

15637b571119e1026e585e7e281f62b6
SHA1

14571735f78809c3bfc2451493a1bc8d2069cd83
SHA256

a3d0e24fafc3e7a8c7fc46cf1a60abf5b816e32e902516d5146b9106dec0df16
SHA512

bf19e32b35c0fdd0a64ccca28471933f40f09261bc25685a00ec06c3783348de93f48252c3dbd4ede99346d81b8ae306d5ee3e766280c280ae4e58ed465aab49
SSDEEP

12288:vYXQR4WtTPj26iZJKjEc4aFR4hvVzH8/3shQI:vYXQR4WZjhQCEH/ls0QI

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
15637b571119e1026e585e7e281f62b6

Files

15637b571119e1026e585e7e281f62b6
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

Size: 3KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 31KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Themida
Size: 576KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE