512092c337f266b15163055e18e8dd01 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

512092c337f266b15163055e18e8dd01
Size

970KB
MD5

512092c337f266b15163055e18e8dd01
SHA1

21d9de54dfc81b18105dd127206b0e21150a4672
SHA256

c53866c0f16ee297e79071df24adab7f48d0bb29c76f5cdd619c440d8e0faa25
SHA512

8f47744bbbba12a19dd2a75ef8961f46782a632ed172ba9b53e345e8fd4296ec045c9467c0f791bac56386ff16c931d8c0ac8c04ce060832e90c875b6b1cdd77
SSDEEP

12288:PrtBhC8uM77j8HPo8HZ1676hio4Ew5YtH7SHfoInxqnYAG1usg937sBTAJ3Cvhq7:ztBhlL8HL1ZhiREwWN+HfK2u4w

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
512092c337f266b15163055e18e8dd01

Files

512092c337f266b15163055e18e8dd01
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

Size: 313KB - Virtual size: 692KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Themida
Size: 638KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE