972282f0317f60e7e633db78ba110902 | Triage

Sharing

General

Target

972282f0317f60e7e633db78ba110902
Size

1.6MB
MD5

972282f0317f60e7e633db78ba110902
SHA1

34e3ecd3f940795bd90a17f61490cdaf86a2b1e4
SHA256

e1932ca9b4d6f226f95134d049c84d4cfd6b9f5a1be3aba0337ca65611e919d3
SHA512

de515b80f834aef003b51ba451af8265582e4717052beccff7edbad856bf7ca7f02323a180885628dc6d29c89987079a68d3b27b818d7292002c4ba13746575d
SSDEEP

49152:WZh/1Qgp3ddF8VAF6E0VYXai5/ermOR8qPuV:iL5F8VG6TVYqYe6OR8q+

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
972282f0317f60e7e633db78ba110902

Files

972282f0317f60e7e633db78ba110902
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

Size: 387KB - Virtual size: 664KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Themida
Size: 1.3MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE