1c5dfc3679c9309bbbafd76a3633aa92 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1c5dfc3679c9309bbbafd76a3633aa92
Size

1.1MB
MD5

1c5dfc3679c9309bbbafd76a3633aa92
SHA1

debdf014279df329f8bfab3fa2ea320da0519251
SHA256

033ddaa179bafd880aa740f086c00c49cbe11b4fef3804a6d304f6e12a5e389f
SHA512

b5e488ae567da6e7b12b503395a1744022a48b11d12a63efaa740b82cc5be8b14d15a767005e0d8d6772d7c505a9db2faf1d0a0faacc6c9676d79b4cd0abbc8c
SSDEEP

24576:reHLFih71dbhLaEo3HiKHBa93Qr5jAhYKkN8lhZ+cTGxe6+I8U/61g:KrMlVaEgHioVjAhY8GxJJie

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1c5dfc3679c9309bbbafd76a3633aa92

Files

1c5dfc3679c9309bbbafd76a3633aa92
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 332KB - Virtual size: 332KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 112KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Themida
Size: 696KB - Virtual size: 700KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE