451e6fa7e781f7b7b83206371c03b7f13faa411e236363a7dbe3a584da7bb9ae

Sharing

Copy URL Twitter E-mail

General

Target
451e6fa7e781f7b7b83206371c03b7f13faa411e236363a7dbe3a584da7bb9ae
Size 3.6MB
Sample260803-1b2n2aga77
SHA256 451e6fa7e781f7b7b83206371c03b7f13faa411e236363a7dbe3a584da7bb9ae
MD5 b15fb94789f9eadd55c3c6019630a4d8
SHA1 7d915fbb2eb9fb53ec311cb74b676cf42b8056cd
SHA512 2482babc13d2a6fe976bf70cb1338a699b052bd3a7cf0b89e3fdebd0c680becc26983c39516badbb760a8eb0bf8467ce57fe36724356298e231eead740b04fe0
SSDEEP 49152:fWNTqefGz4uHqczTJBFlCiGFkOhH7pytQdEPX8NawNhlzlUmjg92N9SLaNW6ylv:fgbQTnFez/ytbf8NZhlzl5jgkHzM
TLSH
T1360633D5D3B16CB2D7D6DEB1F417208E93C8A331E9E4227CF6182461193DB095AE6E83
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
451e6fa7e781f7b7b83206371c03b7f13faa411e236363a7dbe3a584da7bb9ae

File Explorer

451e6fa7e781f7b7b83206371c03b7f13faa411e236363a7dbe3a584da7bb9ae

.exe 3.6MB

451e6fa7e781f7b7b83206371c03b7f13faa411e236363a7dbe3a584da7bb9ae

SHA256 451e6fa7e781f7b7b83206371c03b7f13faa411e236363a7dbe3a584da7bb9ae
MD5 b15fb94789f9eadd55c3c6019630a4d8
SHA1 7d915fbb2eb9fb53ec311cb74b676cf42b8056cd
SHA512 2482babc13d2a6fe976bf70cb1338a699b052bd3a7cf0b89e3fdebd0c680becc26983c39516badbb760a8eb0bf8467ce57fe36724356298e231eead740b04fe0
SSDEEP 49152:fWNTqefGz4uHqczTJBFlCiGFkOhH7pytQdEPX8NawNhlzlUmjg92N9SLaNW6ylv:fgbQTnFez/ytbf8NZhlzl5jgkHzM
TLSH
T1360633D5D3B16CB2D7D6DEB1F417208E93C8A331E9E4227CF6182461193DB095AE6E83
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

255078488

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

Size

813KB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

81KB

Virtual Size

209KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

47KB

Virtual Size

236.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

1KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

generic

count=20, id=259, version=33145,

count=192, id=261, version=33145,

count=2, id=257, version=30151,

count=2, id=221, productName=VS2013 UPD3 build 30723, version=30723,

count=2, id=257, productName=VS2022 v17.0.0 pre 7.0 build 30705, version=30705,

count=1, id=263, version=33145,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=253, version=35721,

count=25, id=259, version=35721,

count=18, id=260, version=35721,

count=2, id=156, productName=VS2010 build 30319, version=30319,

count=80, id=261, version=35721,

count=1, id=158, productName=VS2010 build 30319, version=30319,

count=6, id=170, productName=VS2010 build 30319, version=30319,

count=24, id=260, version=33145,

count=2, id=11, version=8447,

count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=30, id=257, version=33145,

count=1, id=96, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=379, id=1, productName=Unmarked objects,

count=88, id=261, version=36248,

count=1, id=255, version=36248,

count=1, id=151,

count=1, id=258, version=36248,