4a49efa41cefb3734702ee32aeb05f42 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4a49efa41cefb3734702ee32aeb05f42
Size

8.5MB
MD5

4a49efa41cefb3734702ee32aeb05f42
SHA1

c0f6707d89883fe500328016f5bd49d36f9277d0
SHA256

400c822e016849dfb4c4b2248b3f8f01ed806a18184aae2952a94339601ebcad
SHA512

b51e0493651e4623e00055bd337159a4aa271bb6d198599b59beeef13dadc567feb57c9a22e92472c62c6534cd9d21695892e9f78ee37e2a9674516a7623cab6
SSDEEP

196608:+22qStMXWFvRu+jAxsOfDWO46BeEAT4I1acY1aNBbnrhZllgRJjX/x+caMgyuVRV:jS+G5AxsOfDp46BeEAT4I1acYcNBbnrH

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4a49efa41cefb3734702ee32aeb05f42

Files

4a49efa41cefb3734702ee32aeb05f42
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 41KB - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 53KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.imports
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.themida
Size: 8.4MB - Virtual size: 8.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE