49578c53ebec5b264bcff7f904216015 | Triage

Sharing

General

Target

49578c53ebec5b264bcff7f904216015
Size

2.8MB
MD5

49578c53ebec5b264bcff7f904216015
SHA1

e0cb0e2bf73410fa726e0eba7419f1fac0555eb2
SHA256

102b0d7ad78b95f0374815e1037e1ce3064ab282116e6fe34c1ef6c7bda06dce
SHA512

be089d9641268a92f9b21c8c50b04707cc09acba23d76551e3753795c906da7755ad327441a36ce8d8522ee2bb0375ad2b65868bc9ff533310a883d66020965f
SSDEEP

49152:2n6FI+QYgDAfysSyvChkxqlpS0RaY7l5skEXQ8exVsOY+4LGGSlhK05tVJ:E6FRQmasG3aclqk78exVXiuFH

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
49578c53ebec5b264bcff7f904216015

Files

49578c53ebec5b264bcff7f904216015
.exe windows:5 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 341KB - Virtual size: 636KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 30KB - Virtual size: 142KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 4KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 97KB - Virtual size: 656KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.imports
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 170KB - Virtual size: 170KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 3.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ