3fb16b1eb89c2a888af4ff93e0cdc498 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3fb16b1eb89c2a888af4ff93e0cdc498
Size

5.8MB
MD5

3fb16b1eb89c2a888af4ff93e0cdc498
SHA1

b877f086baad8cf1df5864e4e47bce2fd44c61df
SHA256

402d4886a32cc715dc8fd81c802816cea175d27b2301490eff0e658994a316a1
SHA512

251d5969a6889cfb3d1d8ecf77d7674562627ab52c2d5a2ed61035bf29349ee16bb553236df7a5c952adfd29753c7082cc373cff60d1e9d6f01fe161b795a26c
SSDEEP

98304:JEzztmC70U+a+wbbf6jFnDC/sU+iKj29NnApxG0Nw7e3FlpfD:+zks4aytUwj27nyx9QevZ

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3fb16b1eb89c2a888af4ff93e0cdc498

Files

3fb16b1eb89c2a888af4ff93e0cdc498
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 43KB - Virtual size: 104KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 585B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 15B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.imports
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 8.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 5.7MB - Virtual size: 5.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ