6bd479dd9293043d4149641897629169df609adf72926d32adfe0094c583828e[.]exe

General

Target
6bd479dd9293043d4149641897629169df609adf72926d32adfe0094c583828e.exe
Size 6.6MB
Sample240526-jtylnacf92
SHA256 6bd479dd9293043d4149641897629169df609adf72926d32adfe0094c583828e
MD5 f0587649682207064554a2372966435d
SHA1 2e8b948dfcffceb8acf550a585d2ea127f28f41f
SHA512 f5d683b9f71f5f3647d0592f801c02f1dcea7eb49b16fa2e481487d0abc1770610dc9182148a68f749b19950fc3b122911ae0fd1b167ce5dde31931a14b45fdd
SSDEEP 49152:/d84kqSab6V599+xS6Zokh5QK4SbHo/xak/tMw1NxcwCr4RCmUUdr5snBK0PSGUh:/G4kwGb948Aok/+OwVRcwksVsnkL7
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6bd479dd9293043d4149641897629169df609adf72926d32adfe0094c583828e.exe

File Explorer

6bd479dd9293043d4149641897629169df609adf72926d32adfe0094c583828e.exe

.exe 6.6MB

6bd479dd9293043d4149641897629169df609adf72926d32adfe0094c583828e.exe

SHA256 6bd479dd9293043d4149641897629169df609adf72926d32adfe0094c583828e
MD5 f0587649682207064554a2372966435d
SHA1 2e8b948dfcffceb8acf550a585d2ea127f28f41f
SHA512 f5d683b9f71f5f3647d0592f801c02f1dcea7eb49b16fa2e481487d0abc1770610dc9182148a68f749b19950fc3b122911ae0fd1b167ce5dde31931a14b45fdd
SSDEEP 49152:/d84kqSab6V599+xS6Zokh5QK4SbHo/xak/tMw1NxcwCr4RCmUUdr5snBK0PSGUh:/G4kwGb948Aok/+OwVRcwksVsnkL7
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

12272871

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

Size

2.4MB

Virtual Size

9.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

2KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

104KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.themida

Size

4.1MB

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

6bd479dd9293043d4149641897629169df609adf72926d32adfe0094c583828e.exe

generic