2eb55630ffab9f62a0e4352c00b15f9c71802c77c0251276bce75b77147b45e0

Sharing

Copy URL Twitter E-mail

General

Target
2eb55630ffab9f62a0e4352c00b15f9c71802c77c0251276bce75b77147b45e0
Size 14.7MB
Sample240529-aesx7abb26
SHA256 2eb55630ffab9f62a0e4352c00b15f9c71802c77c0251276bce75b77147b45e0
MD5 bda820b9014da632aa75ec7267503102
SHA1 57684e62ce0def5b885f57030f923b0003a2b1fc
SHA512 8992f6fa02550feaf0eab8241adfa2ebdffc77ad73f51f16ba00542c8d0b607bdff6795673d3038d834904d85cf8d203c50161c8c0a04f35a9b74b174c833d65
SSDEEP 393216:C3MYxkoEia3EzDoeldccdxLJSf1rFZ1xyZs63/U:qLJtHzDoeQits51x0S
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2eb55630ffab9f62a0e4352c00b15f9c71802c77c0251276bce75b77147b45e0

File Explorer

2eb55630ffab9f62a0e4352c00b15f9c71802c77c0251276bce75b77147b45e0

.exe 14.7MB

2eb55630ffab9f62a0e4352c00b15f9c71802c77c0251276bce75b77147b45e0

SHA256 2eb55630ffab9f62a0e4352c00b15f9c71802c77c0251276bce75b77147b45e0
MD5 bda820b9014da632aa75ec7267503102
SHA1 57684e62ce0def5b885f57030f923b0003a2b1fc
SHA512 8992f6fa02550feaf0eab8241adfa2ebdffc77ad73f51f16ba00542c8d0b607bdff6795673d3038d834904d85cf8d203c50161c8c0a04f35a9b74b174c833d65
SSDEEP 393216:C3MYxkoEia3EzDoeldccdxLJSf1rFZ1xyZs63/U:qLJtHzDoeQits51x0S
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

41308248

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

Size

1009KB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

113KB

Virtual Size

330KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

7.9MB

Virtual Size

28.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

145KB

Virtual Size

1001KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

52KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

512B

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.edata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

generic

count=11, id=11, version=8047,

count=6, id=10, version=8047,

count=8, id=12, version=7291,

count=44, id=19, version=8022,

count=44, id=14, version=7299,

count=36, id=19, version=8034,

count=792, id=1, productName=Unmarked objects,

count=3, id=93, version=2179,

count=9, id=18, version=8444,

count=1, id=149, productName=VS2008 SP1 build 30729, version=30729,

count=159, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=273, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=153, id=11, productName=VS98 (6.0) build 8168, version=8168,

count=63, id=10, productName=VS98 (6.0) build 8168, version=8168,

count=98, productName=Unmarked objects (old),

count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,

count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,