ade6c4173e20c82ef378f8d9657a133e | Triage

Sharing

General

Target

ade6c4173e20c82ef378f8d9657a133e
Size

664KB
MD5

ade6c4173e20c82ef378f8d9657a133e
SHA1

eea90f5f97a34ecc0f52b1bbc37002e233f035eb
SHA256

687854bf9acf27d3e6cb7038cde2733f3533077750dcdd8526bba11489920d51
SHA512

de693144b1bef5a8dc253e64afe9c99d95a2446817bac2122ef2545b467e36559e32fba5d245ce072f907a5608ced7ec24b55cc96790305d3698d48eb390c8ce
SSDEEP

12288:uWLD2+wWQl6JSwL2pLd0M8kLQScX/QkFdvU6eUyNOQWwsFiAeoilvth:NLD21WlcKkSJdvUsMuvFKoillh

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ade6c4173e20c82ef378f8d9657a133e

Files

ade6c4173e20c82ef378f8d9657a133e
.dll windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

Size: 46KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 688B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Themida
Size: 613KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE