eeb5aab21939113b05dce311a966ce7b7a29aaa4c7b7dbdc51fc5cd984a0ce4d

Sharing

Copy URL Twitter E-mail

General

Target
eeb5aab21939113b05dce311a966ce7b7a29aaa4c7b7dbdc51fc5cd984a0ce4d
Size 3.6MB
Sample260802-frj4psvepb
SHA256 eeb5aab21939113b05dce311a966ce7b7a29aaa4c7b7dbdc51fc5cd984a0ce4d
MD5 ee9cd9daa074862732e1cb81fca8d4cb
SHA1 cee18fbf8d51a8671c6d390d3faac47757faa33b
SHA512 ca20eabb1893d30cef82afe05fc75383a34a256e2cf3fa948c3bbd00e53af565329bc290c54aff6629f97ec836124b16c819e969d07fab606c58b702a6e324b1
SSDEEP 98304:2kvSwF7r1JEJ/Q9D8G+y8uYZyTTxPx/4gQgiN:2lwFvTEGdV+yCynxPx/SR
TLSH
T187063333343D9D1BEC99AFF316F21A22F6C1DBA8EDC8C45D99AE580E16606C321D584D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
eeb5aab21939113b05dce311a966ce7b7a29aaa4c7b7dbdc51fc5cd984a0ce4d

File Explorer

eeb5aab21939113b05dce311a966ce7b7a29aaa4c7b7dbdc51fc5cd984a0ce4d

.exe 3.6MB

eeb5aab21939113b05dce311a966ce7b7a29aaa4c7b7dbdc51fc5cd984a0ce4d

SHA256 eeb5aab21939113b05dce311a966ce7b7a29aaa4c7b7dbdc51fc5cd984a0ce4d
MD5 ee9cd9daa074862732e1cb81fca8d4cb
SHA1 cee18fbf8d51a8671c6d390d3faac47757faa33b
SHA512 ca20eabb1893d30cef82afe05fc75383a34a256e2cf3fa948c3bbd00e53af565329bc290c54aff6629f97ec836124b16c819e969d07fab606c58b702a6e324b1
SSDEEP 98304:2kvSwF7r1JEJ/Q9D8G+y8uYZyTTxPx/4gQgiN:2lwFvTEGdV+yCynxPx/SR
TLSH
T187063333343D9D1BEC99AFF316F21A22F6C1DBA8EDC8C45D99AE580E16606C321D584D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

254865496

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

Size

813KB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

81KB

Virtual Size

209KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

47KB

Virtual Size

236.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

1KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

generic

count=20, id=259, version=33145,

count=192, id=261, version=33145,

count=2, id=257, version=30151,

count=2, id=221, productName=VS2013 UPD3 build 30723, version=30723,

count=2, id=257, productName=VS2022 v17.0.0 pre 7.0 build 30705, version=30705,

count=1, id=263, version=33145,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=253, version=35721,

count=25, id=259, version=35721,

count=18, id=260, version=35721,

count=2, id=156, productName=VS2010 build 30319, version=30319,

count=80, id=261, version=35721,

count=1, id=158, productName=VS2010 build 30319, version=30319,

count=6, id=170, productName=VS2010 build 30319, version=30319,

count=24, id=260, version=33145,

count=2, id=11, version=8447,

count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=30, id=257, version=33145,

count=1, id=96, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=379, id=1, productName=Unmarked objects,

count=88, id=261, version=36248,

count=1, id=255, version=36248,

count=1, id=151,

count=1, id=258, version=36248,