3e583472cc7b1ec6e902b2638b300196 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3e583472cc7b1ec6e902b2638b300196
Size

5.3MB
MD5

3e583472cc7b1ec6e902b2638b300196
SHA1

bf5444add031617f5a4a9c21de7dbeea8c55a138
SHA256

6bfd0efd21b16b65ec00ab4ccb84c6fbdde82f603f708ccc7370bcfc00b7384b
SHA512

83d6e58d9a5119ad061f7cd1a2e622952da1d622844124b8f2b2e8af5c5426ce1b44ecce287d260860711936eb66c0aa4ee6793bed19f6d9d2b1838a410b685c
SSDEEP

98304:NmGxNj2h5Y0s1+eaSsuUKX2DtDHHvFejzsYThtX1JdSn28ALB4qq+R:M4onXs1NaXV7bejzsYTHFJK2VLB4SR

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3e583472cc7b1ec6e902b2638b300196

Files

3e583472cc7b1ec6e902b2638b300196
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 41KB - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 582B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 15B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.imports
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 8.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 5.3MB - Virtual size: 5.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ