5bef4e821873968ecc4dee3e5f652268 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5bef4e821873968ecc4dee3e5f652268
Size

4.6MB
MD5

5bef4e821873968ecc4dee3e5f652268
SHA1

5007dedbb53c653e33853f23565ee13d3b3c663c
SHA256

b45621388d1796207bc5e48c7443ececbaa419457e667ee677ee5fb77e3e198f
SHA512

b88048306ce9d50a4de2b70854ec361d53211583efabe08f42d61472a8a97d24b1d1fa500cfa57e4eadfdd9b800a4bb609bf8abc66d9d9022a1606146214cb66
SSDEEP

98304:SV6iG/rWG0xwQ1bRBBcgwQ42I0DmQDQ/VQGioC9mWKgok:frWB7bHBcgG2I0I/2GiA

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5bef4e821873968ecc4dee3e5f652268

Files

5bef4e821873968ecc4dee3e5f652268
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

Size: 444KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.5MB - Virtual size: 14.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Themida
Size: 686KB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE