1ae039b0419adbc9e44a2418f4fb32740fe4ca1444ebc15bf2ae087418ddc2aa

Sharing

Copy URL Twitter E-mail

General

Target
1ae039b0419adbc9e44a2418f4fb32740fe4ca1444ebc15bf2ae087418ddc2aa
Size 14.8MB
Sample260512-e7a1asex81
SHA256 1ae039b0419adbc9e44a2418f4fb32740fe4ca1444ebc15bf2ae087418ddc2aa
MD5 4b6b927d9f6dec80de335125f1675db0
SHA1 0a64f121108e62ac3221f72847e329d32fca90e9
SHA512 a5068350c2006ed0e228346eba6f149395d4edf68f40ac54cd1bada633ff60305cf3d25c531d248e3c4e8d4f64e6d97c7e72db80e6f802b9db47096dcf6a4ab3
SSDEEP 393216:N9ZLuqwkr70n9KEhiiQyAxmgyElKBsc29NMs60xdX:V09XhiiQjmdtBb0x
TLSH
T1E6F633DA5451C577C5888A39BFB9A13800EBEDAEADD12197E1C47309B8B9E433607633
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1ae039b0419adbc9e44a2418f4fb32740fe4ca1444ebc15bf2ae087418ddc2aa

File Explorer

1ae039b0419adbc9e44a2418f4fb32740fe4ca1444ebc15bf2ae087418ddc2aa

.exe 14.8MB

1ae039b0419adbc9e44a2418f4fb32740fe4ca1444ebc15bf2ae087418ddc2aa

SHA256 1ae039b0419adbc9e44a2418f4fb32740fe4ca1444ebc15bf2ae087418ddc2aa
MD5 4b6b927d9f6dec80de335125f1675db0
SHA1 0a64f121108e62ac3221f72847e329d32fca90e9
SHA512 a5068350c2006ed0e228346eba6f149395d4edf68f40ac54cd1bada633ff60305cf3d25c531d248e3c4e8d4f64e6d97c7e72db80e6f802b9db47096dcf6a4ab3
SSDEEP 393216:N9ZLuqwkr70n9KEhiiQyAxmgyElKBsc29NMs60xdX:V09XhiiQjmdtBb0x
TLSH
T1E6F633DA5451C577C5888A39BFB9A13800EBEDAEADD12197E1C47309B8B9E433607633
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

26910808

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

Size

524KB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

9.3MB

Virtual Size

16.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

36KB

Virtual Size

433KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

168KB

Virtual Size

283KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

268KB

Virtual Size

268KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

Virtual Size

6.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

4.5MB

Virtual Size

4.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

1ae039b0419adbc9e44a2418f4fb32740fe4ca1444ebc15bf2ae087418ddc2aa

generic