sub_2150dbdddb2a[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
sub_2150dbdddb2a.bin
Size 5.0MB
Sample260524-b5bbhaet2m
SHA256 2150dbdddb2a234bcf8f52b5c4019a6d75bcf34e6d9bee760eb27a126f5da3f7
MD5 ea1b987a7fdfc2996d5f314a20fd4d99
SHA1 a79aa6d617c0dc8973056a1bc6bdbd448d4fb298
SHA512 9583c20ca5efc6c51a9258e1f5a43e0e79b9fdf592eb1f294245afc38766a66c65b0a460c3250f8455c16491f5e1973fa8fac2d0fe543727c7fa8584c6d1e3f8
SSDEEP 98304:IKPfR/RzaEe9L8j0MB6nYxAnV5HkUXVL6yzHAkx:I2fR/Rza9LJW6YinVRXVm4Akx
TLSH
T15036338222C29ED6E42BDBF2BE16415A5C07EA210FA51435D1BF0EF3B1A512D4F782DD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
sub_2150dbdddb2a.bin

File Explorer

sub_2150dbdddb2a.bin

.exe 5.0MB

sub_2150dbdddb2a.bin

SHA256 2150dbdddb2a234bcf8f52b5c4019a6d75bcf34e6d9bee760eb27a126f5da3f7
MD5 ea1b987a7fdfc2996d5f314a20fd4d99
SHA1 a79aa6d617c0dc8973056a1bc6bdbd448d4fb298
SHA512 9583c20ca5efc6c51a9258e1f5a43e0e79b9fdf592eb1f294245afc38766a66c65b0a460c3250f8455c16491f5e1973fa8fac2d0fe543727c7fa8584c6d1e3f8
SSDEEP 98304:IKPfR/RzaEe9L8j0MB6nYxAnV5HkUXVL6yzHAkx:I2fR/Rza9LJW6YinVRXVm4Akx
TLSH
T15036338222C29ED6E42BDBF2BE16415A5C07EA210FA51435D1BF0EF3B1A512D4F782DD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8708184

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

Size

1.4MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

280KB

Virtual Size

686KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

9KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

1KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

85KB

Virtual Size

146KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.imports

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.themida

Size

Virtual Size

4.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

3.3MB

Virtual Size

3.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

16B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ

generic

count=30, id=241, version=40116,

count=199, id=243, version=40116,

count=36, id=242, version=40116,

count=6, id=199, version=41118,

count=28, id=259, version=24123,

count=359, id=260, productName=VS2019 v16.8.3 build 29335, version=29335,

count=10, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=92, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=4, id=208, version=65501,

count=1, id=209, version=65501,

count=3, id=203, version=65501,

count=581, id=1, productName=Unmarked objects,

count=2, id=261, version=23013,

count=5, id=206, version=65501,

count=42, id=260, version=24123,

count=133, id=261, version=24123,

count=138, id=265, version=24215,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,