c26fb8af789c11f5264a5beaeb521d56aeca04e2c1bdf792be73e6eb0596a0eb

Sharing

Copy URL Twitter E-mail

General

Target
c26fb8af789c11f5264a5beaeb521d56aeca04e2c1bdf792be73e6eb0596a0eb
Size 2.0MB
Sample260129-vpvvraaw4e
SHA256 c26fb8af789c11f5264a5beaeb521d56aeca04e2c1bdf792be73e6eb0596a0eb
MD5 72b8eacdc04f767d3f6daa0e46a4f838
SHA1 72232bc762cefd130644f2252f252028b5251a9d
SHA512 b8d08584507755a6191521ad6ec80c0f5f7b7e156c64edaebb270d98399ab0325595a09bd96e6623ee6dc9670207652d66e1cc9fbe99553ce9c3f48c07505196
SSDEEP 49152:3JSg8P7oEFKGjLNpYubbzV0HC6WHPCKw6VfSm+EgkS:pi7dpLXYczWC61Kw6VfSm+E
TLSH
T196A533DD47E62A03FADF42B2F21CD4176B9266D607567DDE8C0812AF194D86DE8B0332
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c26fb8af789c11f5264a5beaeb521d56aeca04e2c1bdf792be73e6eb0596a0eb

File Explorer

c26fb8af789c11f5264a5beaeb521d56aeca04e2c1bdf792be73e6eb0596a0eb

.exe 2.0MB

c26fb8af789c11f5264a5beaeb521d56aeca04e2c1bdf792be73e6eb0596a0eb

SHA256 c26fb8af789c11f5264a5beaeb521d56aeca04e2c1bdf792be73e6eb0596a0eb
MD5 72b8eacdc04f767d3f6daa0e46a4f838
SHA1 72232bc762cefd130644f2252f252028b5251a9d
SHA512 b8d08584507755a6191521ad6ec80c0f5f7b7e156c64edaebb270d98399ab0325595a09bd96e6623ee6dc9670207652d66e1cc9fbe99553ce9c3f48c07505196
SSDEEP 49152:3JSg8P7oEFKGjLNpYubbzV0HC6WHPCKw6VfSm+EgkS:pi7dpLXYczWC61Kw6VfSm+E
TLSH
T196A533DD47E62A03FADF42B2F21CD4176B9266D607567DDE8C0812AF194D86DE8B0332
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3608664

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

Size

54KB

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

6KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

512B

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

512B

Virtual Size

176B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

144KB

Virtual Size

143KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.themida

Size

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

c26fb8af789c11f5264a5beaeb521d56aeca04e2c1bdf792be73e6eb0596a0eb

generic