2d851fdb3925633ed0462cc7ca05bde4 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2d851fdb3925633ed0462cc7ca05bde4
Size

3.3MB
MD5

2d851fdb3925633ed0462cc7ca05bde4
SHA1

c2a757f05113696ff4e1e0eb5c0b2bc864c5601f
SHA256

c4b2796131f8acab6441e55e6f3436b8729664a07f24154aeb8056772557e3dd
SHA512

8b231be374da7d60e11ccb9c9c9560110d5f20c8d4d1047ab08b43ef7c452b1eb59dca6280c89a81919dd9af1f043e70f901025bacc3ec2ec8c1015678b43485
SSDEEP

98304:YaKYMH/h8wCEleP+fvxhe2zXIjULeV8b3:jKYtwds8xhFzY1W3

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2d851fdb3925633ed0462cc7ca05bde4

Files

2d851fdb3925633ed0462cc7ca05bde4
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 41KB - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 49KB - Virtual size: 192KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 15B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.imports
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 193KB - Virtual size: 193KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 4.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ