df54ee10dfbee808ff9217543b2c98c1 | Triage

Sharing

General

Target

df54ee10dfbee808ff9217543b2c98c1
Size

728KB
MD5

df54ee10dfbee808ff9217543b2c98c1
SHA1

f1492a306387f1c57adf511edadd8ee5dd24b8eb
SHA256

19a08da7759d3d5573d0d085b00f5f9a8737b3b0b2b521fc8e9d9c707c14f6e2
SHA512

a478ae4a9b8f5a13f0989b036795013e010a8b76381349207618c5765d863e9d0e7c6f87f7f6972860f5c1534199de94a8eecfe3594c7b15f01191bf22eff8d3
SSDEEP

12288:O9B8NwGLFD/b0bI68JlYZia+GARXuMnCV0avwYhqy0xSwEDU9AKRe/DzsPJdRs:Y+LF7b0bI6+lFFGcovlq/AsODwP1

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
df54ee10dfbee808ff9217543b2c98c1

Files

df54ee10dfbee808ff9217543b2c98c1
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

Size: 162KB - Virtual size: 368KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 18KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.fish
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.fish
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Themida
Size: 542KB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE