bb4052f288c0f5800767488f5fc95a733c6c90379d57f68dfefd47a21c7cbeee

Sharing

Copy URL Twitter E-mail

General

Target
bb4052f288c0f5800767488f5fc95a733c6c90379d57f68dfefd47a21c7cbeee
Size 6.0MB
Sample260714-g211mshy21
SHA256 bb4052f288c0f5800767488f5fc95a733c6c90379d57f68dfefd47a21c7cbeee
MD5 838ade938e43295f41eb07ffa05e5457
SHA1 84ebb35d208995c368f8cc8399abcd7183c78399
SHA512 c4acfaced9f06f6b53b3fdf9cf845dcd50497f423239a4bae52ebf2a27e0e5d2c9a69b410cbab6855b366b83e9960d93d3f9c23ddc5a430b27316703dee6b61b
SSDEEP 98304:rm8o7GcQuYFAugOaqMNGPu4No7ic/y/zC8G4Za3ajVNfamAEyWU:yd8FzaqMHV/y/XG2aq5nhyW
TLSH
T16A5633AF56CAAF92C03E76BA76557A21B24D0F299BB7770E1D310490DB2CDF49C81035
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bb4052f288c0f5800767488f5fc95a733c6c90379d57f68dfefd47a21c7cbeee

File Explorer

bb4052f288c0f5800767488f5fc95a733c6c90379d57f68dfefd47a21c7cbeee

.exe 6.0MB

bb4052f288c0f5800767488f5fc95a733c6c90379d57f68dfefd47a21c7cbeee

SHA256 bb4052f288c0f5800767488f5fc95a733c6c90379d57f68dfefd47a21c7cbeee
MD5 838ade938e43295f41eb07ffa05e5457
SHA1 84ebb35d208995c368f8cc8399abcd7183c78399
SHA512 c4acfaced9f06f6b53b3fdf9cf845dcd50497f423239a4bae52ebf2a27e0e5d2c9a69b410cbab6855b366b83e9960d93d3f9c23ddc5a430b27316703dee6b61b
SSDEEP 98304:rm8o7GcQuYFAugOaqMNGPu4No7ic/y/zC8G4Za3ajVNfamAEyWU:yd8FzaqMHV/y/XG2aq5nhyW
TLSH
T16A5633AF56CAAF92C03E76BA76557A21B24D0F299BB7770E1D310490DB2CDF49C81035
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9478232

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

Size

7KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

2KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

384B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

512B

Virtual Size

828B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

744B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

Virtual Size

9.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

6.0MB

Virtual Size

6.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

bb4052f288c0f5800767488f5fc95a733c6c90379d57f68dfefd47a21c7cbeee

generic