WindowsFormsApp1_protected[.]exe | Triage

Sharing

General

Target

WindowsFormsApp1_protected.exe
Size

4.6MB
MD5

ec9dd2a53fcbf71ff64b2e10eba30598
SHA1

751e31b275f57e0f4c8e9c66d035fdbad8139679
SHA256

cad88795d87cb584074e90572ea83e0c870a98128eb2d5f12af130d76ee20772
SHA512

dffd6899ac2082522308a5e23df5d883a4b59f6ef87ddfea621684f390e66ce6c19d70d1465a4885723884d8367fcec72db1c8832ea0c974813bcaa95788bf07
SSDEEP

98304:vtvJmh+/u/pY/PAcd7CYoGmnZDQQcx+E5xc6W:ah4YpABF3mnZ1mDW

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WindowsFormsApp1_protected.exe

Files

WindowsFormsApp1_protected.exe
.exe windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Size: 8KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 7.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 4.6MB - Virtual size: 4.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ