6ae3498cb9a5ba2b89861ecd5af12627

General

Target
6ae3498cb9a5ba2b89861ecd5af12627
Size 12.4MB
Sample240120-tt5p3sdca8
SHA256 fab22062cd6dca945108eec308117d1f61776f165a589b0dc40631e853f54739
MD5 6ae3498cb9a5ba2b89861ecd5af12627
SHA1 274f104b6115ede9bf664ba7a82862dc35808bba
SHA512 4523fae5e13f8a23afd0b2a1ee905ac6714b2f2c52892c807d3ee3cc8065a41ff1f8c3a70e34c19c32737b11e6228c3ecdf394e5fbe0b24b3894398785558bef
SSDEEP 196608:pFYCPzfo99IAREBpvabnMxoVu1AQLC00atf/V85x8ew1Gfp4q/J4iylWCpmKLQgU:dPro99IACv7r1Jkav4xigxJ/clW3gs9
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6ae3498cb9a5ba2b89861ecd5af12627

File Explorer

6ae3498cb9a5ba2b89861ecd5af12627

.exe 12.4MB

6ae3498cb9a5ba2b89861ecd5af12627

SHA256 fab22062cd6dca945108eec308117d1f61776f165a589b0dc40631e853f54739
MD5 6ae3498cb9a5ba2b89861ecd5af12627
SHA1 274f104b6115ede9bf664ba7a82862dc35808bba
SHA512 4523fae5e13f8a23afd0b2a1ee905ac6714b2f2c52892c807d3ee3cc8065a41ff1f8c3a70e34c19c32737b11e6228c3ecdf394e5fbe0b24b3894398785558bef
SSDEEP 196608:pFYCPzfo99IAREBpvabnMxoVu1AQLC00atf/V85x8ew1Gfp4q/J4iylWCpmKLQgU:dPro99IACv7r1Jkav4xigxJ/clW3gs9
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x64 arch:x64

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

32505856

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

Size

109KB

Virtual Size

272KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

38KB

Virtual Size

295KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.imports

Size

512B

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

296KB

Virtual Size

296KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

Virtual Size

18.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

12.0MB

Virtual Size

12.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.taggant

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

6ae3498cb9a5ba2b89861ecd5af12627

generic