afae5742a065ca3f97c8d257cc1763f0N[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

afae5742a065ca3f97c8d257cc1763f0N.exe
Size

6.5MB
MD5

afae5742a065ca3f97c8d257cc1763f0
SHA1

a53d65ae54b54b72eb02b2d7ee5c6491fa510c72
SHA256

c2269d2cc20482b9ed09b0838c60b538ea2eed3071dabd9e263dd1e0f2106b3f
SHA512

476936ce5c8ff502d21042ea6eb6f6ed5ee3df313fbb6e9e4c4e32959ee856d2f11da5a33e989d99502fa9d491511bffd3e1ae5205eb41d247cfc240353d33ed
SSDEEP

196608:plzGIpe/EqTL1FBCKy/MvWhxA9Ci4vDjc7oHgB:pFGHzBBgMvU0n4s7oHC

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
afae5742a065ca3f97c8d257cc1763f0N.exe

Files

afae5742a065ca3f97c8d257cc1763f0N.exe
.exe windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 636KB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 97KB - Virtual size: 270KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 192KB - Virtual size: 360KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 41KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.idata
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.themida
Size: - Virtual size: 7.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 5.5MB - Virtual size: 5.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 16B - Virtual size: 4KB

IMAGE_SCN_MEM_READ