57880591860552ed5038cf4125e2daa4 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

57880591860552ed5038cf4125e2daa4
Size

641KB
MD5

57880591860552ed5038cf4125e2daa4
SHA1

5a5bc865fcdd1dbfbec49aa836f5892049292390
SHA256

831b6318e367366e722bbf6bed30eb7c2416b6fbe488f66d44f4823ff6b1be86
SHA512

3c2d8211b0effcf18b636e3b6e46c047f43b31ac979c9f50d803fe0d6b495a48e2a585f7015c6923c5a60c896b0216afbd9c14f17621e370155dd23717d4d277
SSDEEP

12288:Hd0eDDbDCnc9K4GgwMFE+F52LT2NFdIhOWHxKFMgDksPLD:HdxDPDk8VGeIT2eYWYVDksjD

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
57880591860552ed5038cf4125e2daa4

Files

57880591860552ed5038cf4125e2daa4
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

Size: 3KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 33KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Themida
Size: 600KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE