3f3f7bda2762aeb0dcceb4c797871aaf | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3f3f7bda2762aeb0dcceb4c797871aaf
Size

4.1MB
MD5

3f3f7bda2762aeb0dcceb4c797871aaf
SHA1

e167f7d5013b9853277c65c51d30c5b48597d27a
SHA256

d4ba270e1b776371396b371d51a3bd3a6012f243a184355db9775fa9c2e0ce7e
SHA512

8f745f6ef3f7c8d94c541452c265431dd21be4a65f5cd1c4d8778f1c4709bb865c13ea7f2afd5e452e10875494c16cd55a6521262448ecb3149369216c937eed
SSDEEP

98304:o+IiNnz/eEusQArvyaM8zES+Yq4zhQgmCKz:oTEuhUyt8oS+YqEhQv

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3f3f7bda2762aeb0dcceb4c797871aaf

Files

3f3f7bda2762aeb0dcceb4c797871aaf
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 1010KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 19KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 15B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.imports
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 106KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 5.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ