66a70ea643af8db47ed365e37b02ceab | Triage

Sharing

Copy URL Twitter E-mail

General

Target

66a70ea643af8db47ed365e37b02ceab
Size

3.9MB
MD5

66a70ea643af8db47ed365e37b02ceab
SHA1

4e93edc65f4be4190cf57317ee7c8ea21a6a5ba1
SHA256

1ac23868ced4d97f218b7c3d68d36c35aaf2cbc980c82f4e76a1763cf68a3977
SHA512

9ba1372b77a58cd7c11ade55ca7989ca659c4889e62dc398e5e7e276e8df6207a0494649fdc57ae8266244be9a0dcd18d629dd54d9120c419a0689d7a5764595
SSDEEP

49152:IfWSsflhpINXVpSZQdAyFa/SW91Hke0CWwUL2Ge7CbD0yDASnfO8mSoiU7ZFuq2M:yWSsy+S2kTCWwzGjD/htU7ZFuqlSFkN/

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
66a70ea643af8db47ed365e37b02ceab

Files

66a70ea643af8db47ed365e37b02ceab
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 43KB - Virtual size: 104KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 580B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 15B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.imports
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 7.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 3.9MB - Virtual size: 3.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ