8dd6dcd242cbf8f13d837c5f7e0e1046 | Triage

Sharing

General

Target

8dd6dcd242cbf8f13d837c5f7e0e1046
Size

2.9MB
MD5

8dd6dcd242cbf8f13d837c5f7e0e1046
SHA1

152250f4752f3c0a664a984a7246ae8cbf871e48
SHA256

45f4a2155d2bf3d3bc0ad79bf76626a0bd387ee2700e9662372af1c9fdd765bd
SHA512

e17b17d07e99a5b4d719f0e07093031d9fea2bdf0a706d49bad14c8564c7ff268c3369dd7da3e8fa06e5708c818e7fa67f4c2221534066fba148e3960edbef3f
SSDEEP

49152:CAcTH7g5D0izlzzzy6+vo5XFwOJx/9QS1c7IWpn6+ZJE9VlULA8eP3eyIn0zh2C:fD0izlzzz5+vQ++/9XcB6+ZJE9MA8efX

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8dd6dcd242cbf8f13d837c5f7e0e1046

Files

8dd6dcd242cbf8f13d837c5f7e0e1046
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 27KB - Virtual size: 54KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 10KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 491B - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 358KB - Virtual size: 375KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.imports
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 177KB - Virtual size: 177KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 3.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ