72ae4f7bb7ee6cb0e73b448e2a2b6096 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

72ae4f7bb7ee6cb0e73b448e2a2b6096
Size

3.8MB
MD5

72ae4f7bb7ee6cb0e73b448e2a2b6096
SHA1

594eef89a7ef5bae74ef6a2efd8eeebfd0e8eb5b
SHA256

e18249c67b2e718190dfa36a6bd51e99a11998c1318c71b5e4428c54848531bf
SHA512

7bc63209474e2ca26bdeb766697e5d27c8ef531b65381de7b00080f47dab0a5d49df83e352809d06db673b0e535cd27bec3dd964b140bb923e9df530811583c6
SSDEEP

98304:2IGItF+XeyxV+GiRW+XsWF6fg2wIhKKBDtQLtq1GrfbD:2IbyxIGgWp9o2BhKSOtqqbD

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
72ae4f7bb7ee6cb0e73b448e2a2b6096

Files

72ae4f7bb7ee6cb0e73b448e2a2b6096
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Size: 5KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 625B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 16B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.imports
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 6.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 3.8MB - Virtual size: 3.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ