3a63db4b9f17c91468a4c64e04d558b8 | Triage

Sharing

General

Target

3a63db4b9f17c91468a4c64e04d558b8
Size

3.9MB
MD5

3a63db4b9f17c91468a4c64e04d558b8
SHA1

c1f9fd82c2480679161dc98781c4182da899acb4
SHA256

dc0021441e822680364e1ebb39c1793bcfb60ef07b21c6bceb22cb8c621eb353
SHA512

20041dff9b2fe5ad687183d40290fb695666fccb29f86c9b1048cd0b643fffd34be5a312f15bd29aafa799f515163003077b1591a57fc0335cb02234b4cd40ad
SSDEEP

98304:J7nQIKsmjebdvQvhi2q1P4HUWmOt42cjQl/7NQGulP:J7nKDwKi2aS1O2cMB6

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3a63db4b9f17c91468a4c64e04d558b8

Files

3a63db4b9f17c91468a4c64e04d558b8
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

Size: 398KB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.0MB - Virtual size: 10.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Themida
Size: 573KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE