cce29a05e8059f96d080e07077952a76 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

cce29a05e8059f96d080e07077952a76
Size

3.3MB
MD5

cce29a05e8059f96d080e07077952a76
SHA1

afabc37ff0bf4c1b3875a3df7f09d410a1b53566
SHA256

022192cc655fadf46c87183070e29467e03ea523e80be8ef362240341d9a72f7
SHA512

a728489efd322d1aa8a238c8ca423fa2c90098191e40f83abc6746f3fdb694b2f67aa9304017b6a08eff3fac414cab5af34bb7843f4456512cf6466f919618a2
SSDEEP

49152:nKBfHipjOd4PBK0bVaqCgYM9wMq6gkMtQOQEvQ/uVlh1Yhta9p8FZbV+S6wE7vhE:KVikdULZBq1t9vGlzaYFFVH6vrhHJK

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cce29a05e8059f96d080e07077952a76

Files

cce29a05e8059f96d080e07077952a76
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 265KB - Virtual size: 672KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 289B - Virtual size: 680B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 15B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.imports
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 5.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 3.0MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ