7c248b921058883a53134600db447a62 | Triage

Sharing

General

Target

7c248b921058883a53134600db447a62
Size

1.6MB
MD5

7c248b921058883a53134600db447a62
SHA1

f64a399deee0e7026d861884cac5a5e65ba38225
SHA256

e93ecf372ffd7c02755393f20a6e0dfe71ce3a643a64da875495a19faa6f1b81
SHA512

f5c13c1591eac0b82a0a5476799daba3f89efa5531ae46536a94ed95c107d177ea97a6b5682f0d80e9d4455c557332376600fc276dc918437fc3dc3726e807f9
SSDEEP

49152:33dQ3C5TJH0YAP20/qT2AHRQ9fHrBZFSTFjYQbaE:3BTg+0/qa6o3FSTF0QbaE

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7c248b921058883a53134600db447a62

Files

7c248b921058883a53134600db447a62
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 379KB - Virtual size: 378KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Themida
Size: 1.3MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE