f0cac480cf462906583b66071448c040N[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f0cac480cf462906583b66071448c040N.exe
Size

6.3MB
MD5

f0cac480cf462906583b66071448c040
SHA1

c82fdd2ad22cbf2645e70d8a870a2e3d8dc88ab6
SHA256

ef28f6db22d378ae77a756ad1610d4f0de6749fe582487dd989b6cbbf8c2019d
SHA512

1da46e019b25671552fc721da4e7ce4b3756c29cd55cc4ada67e264aedc1774224d103615400c484153d99a0ace71ee3fae545e39b68446b64e5731fe03d6da6
SSDEEP

98304:JZ7XDdOAxcNYSMj0u2Uy14v5uZEM0kB4G3R3C0r6j0phUA1PISmr1vzd:JRXD00IbMjN2MvKEM0kB9UwXH61Ld

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f0cac480cf462906583b66071448c040N.exe

Files

f0cac480cf462906583b66071448c040N.exe
.exe windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 631KB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 97KB - Virtual size: 270KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 192KB - Virtual size: 360KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 41KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.idata
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.themida
Size: - Virtual size: 6.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 5.3MB - Virtual size: 5.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 16B - Virtual size: 4KB

IMAGE_SCN_MEM_READ