b4fe86229a0082ea4b7f918ca886daee | Triage

Sharing

General

Target

b4fe86229a0082ea4b7f918ca886daee
Size

646KB
MD5

b4fe86229a0082ea4b7f918ca886daee
SHA1

b9b00c2abbe7d1ec84d186a8b0f1993916c10c51
SHA256

f01eda83f176d9a08bf10ee9911f71d8034f98876f3df866660bc9b462ec676c
SHA512

bea1094f38f515a4a303a8916a33aed44a10b850e3c4dfa6500dd2f90e9907b03dfcf4ed5d102c2d75ad95ec0ef5131dce0248dd8a817066ae503f804ac5f60d
SSDEEP

12288:7OdsbUVH59GurHPycs05/1EWgxoyp9ed8H097WNulaKaMidQ:7CsbMNvEuzUpm8iIulalu

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b4fe86229a0082ea4b7f918ca886daee

Files

b4fe86229a0082ea4b7f918ca886daee
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 12KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Themida
Size: 629KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE