2251c9b92ed1fb103f4574340c7d5ad6fc6de6758145d92bc605f039f1923b87[.]exe[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

2251c9b92ed1fb103f4574340c7d5ad6fc6de6758145d92bc605f039f1923b87.exe.zip
Size

5.1MB
MD5

de06a93921c2066c386554b1dfce1cfb
SHA1

45682ee7f2b02c7678c44c2d65f538e472c7d7a6
SHA256

c6b9efc81167d9443c12531047f4e6d6dd86937f46751c4395aee5d04f1eac8b
SHA512

35746f3e01cd55629987b18bc5b133a3a40c0480bcd6c536b0b9f4feebfe786311dcbb1ecc55088bfc9a08d7b5827f87c70e662365eebb75a40df6a0b196e316
SSDEEP

98304:By39LHwUhsHmkqmRT3EBMXPDNW7G+q/EC6SK8FzMHjWaoKtiZ0Y1ir6+WtcK:C9LHk+m2BiUF4ajWbKom0i2zn

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
static1/unpack001/2251c9b92ed1fb103f4574340c7d5ad6fc6de6758145d92bc605f039f1923b87.exe	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/2251c9b92ed1fb103f4574340c7d5ad6fc6de6758145d92bc605f039f1923b87.exe

Files

2251c9b92ed1fb103f4574340c7d5ad6fc6de6758145d92bc605f039f1923b87.exe.zip
.zip

Password: infected
2251c9b92ed1fb103f4574340c7d5ad6fc6de6758145d92bc605f039f1923b87.exe
.exe windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 2.0MB - Virtual size: 4.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 246KB - Virtual size: 752KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 24KB - Virtual size: 26.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 3KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 186KB - Virtual size: 400KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 155KB - Virtual size: 279KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.idata
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 400KB - Virtual size: 400KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 3.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 16B - Virtual size: 4KB

IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Headers

DLL Characteristics

File Characteristics

Sections

Size: 2.0MB - Virtual size: 4.7MB

Size: 246KB - Virtual size: 752KB

Size: 24KB - Virtual size: 26.2MB

Size: 3KB - Virtual size: 9KB

Size: 186KB - Virtual size: 400KB

Size: 155KB - Virtual size: 279KB

.idata Size: 1KB - Virtual size: 4KB

.tls Size: 512B - Virtual size: 4KB

.rsrc Size: 400KB - Virtual size: 400KB

.themida Size: - Virtual size: 3.9MB

.boot Size: 2.4MB - Virtual size: 2.4MB

.reloc Size: 16B - Virtual size: 4KB

.idata
Size: 1KB - Virtual size: 4KB

.tls
Size: 512B - Virtual size: 4KB

.rsrc
Size: 400KB - Virtual size: 400KB

.themida
Size: - Virtual size: 3.9MB

.boot
Size: 2.4MB - Virtual size: 2.4MB

.reloc
Size: 16B - Virtual size: 4KB