deb1d807c8a5218a361163b70f061842 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

deb1d807c8a5218a361163b70f061842
Size

976KB
MD5

deb1d807c8a5218a361163b70f061842
SHA1

969b99ba134162d94e03730f913b78089f25995d
SHA256

ca95ce080c00c6326aa40781706a15ac2290d6cc996c0804d0ea7c670e3b3d24
SHA512

b66ef4d27f4935ce0d2f97106b10f3ae93ec9206fce01396477c9d8b7289ccce951aa75f48ab4abb481744cbe42c691fb7547db809f17041f9167ab6dc168f9c
SSDEEP

24576:8gtOwlwtcxngtdURl8Wg/Kf1tNhkKBO3qk/hY:PtOwlwaxngPQ8r/KfrNff

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
static1/unpack001/fotos.cpl	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/fotos.cpl

Files

deb1d807c8a5218a361163b70f061842
.zip
fotos.cpl
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

CPlApplet

Sections

Size: 302KB - Virtual size: 744KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Themida
Size: 655KB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE