3cbdf80a8cbff19184dedf342fcbfa941ef13c2fac65f5aef4a6f5241c888bae

Sharing

Copy URL Twitter E-mail

General

Target
3cbdf80a8cbff19184dedf342fcbfa941ef13c2fac65f5aef4a6f5241c888bae
Size 3.7MB
Sample260810-mbc4sa1vfs
SHA256 3cbdf80a8cbff19184dedf342fcbfa941ef13c2fac65f5aef4a6f5241c888bae
MD5 e0d97fc44740e43f77b91228773b80b8
SHA1 19d80f48f8497d38d460d7059afc9b6a9ede8944
SHA512 18efd9f2b3b9fd5322c225a384637e376b9d13f42eae8787437a99869cd7c6353a2f3264933cef5d491a4c3abc76e0f84a7f4e85e91d1f2569ddb279cf872eaa
SSDEEP 98304:x7pN+XnEcLz7S7/+mfhOmiePusuXS9njs:xoEoz7S7Gmf7iePuos
TLSH
T1DA06339043556F92C21653F4EE331A8E5C0E3E24CA262135D17F97B16E89DDCAB3D9E0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3cbdf80a8cbff19184dedf342fcbfa941ef13c2fac65f5aef4a6f5241c888bae

File Explorer

3cbdf80a8cbff19184dedf342fcbfa941ef13c2fac65f5aef4a6f5241c888bae

.exe 3.7MB

3cbdf80a8cbff19184dedf342fcbfa941ef13c2fac65f5aef4a6f5241c888bae

SHA256 3cbdf80a8cbff19184dedf342fcbfa941ef13c2fac65f5aef4a6f5241c888bae
MD5 e0d97fc44740e43f77b91228773b80b8
SHA1 19d80f48f8497d38d460d7059afc9b6a9ede8944
SHA512 18efd9f2b3b9fd5322c225a384637e376b9d13f42eae8787437a99869cd7c6353a2f3264933cef5d491a4c3abc76e0f84a7f4e85e91d1f2569ddb279cf872eaa
SSDEEP 98304:x7pN+XnEcLz7S7/+mfhOmiePusuXS9njs:xoEoz7S7Gmf7iePuos
TLSH
T1DA06339043556F92C21653F4EE331A8E5C0E3E24CA262135D17F97B16E89DDCAB3D9E0
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

248107184

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

Size

563KB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

50KB

Virtual Size

140KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

36KB

Virtual Size

230.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

7KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

88KB

Virtual Size

110KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

Virtual Size

4.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

16B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ

generic

count=7, id=170, productName=VS2010 build 30319, version=30319,

count=104, id=260, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=1, id=263, version=30795,

count=4, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=11, id=253, version=33808,

count=9, id=259, version=33808,

count=12, id=260, version=33808,

count=34, id=261, version=33808,

count=4, id=257, version=33808,

count=2, id=156, productName=VS2010 build 30319, version=30319,

count=2, id=11, version=8447,

count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=32, id=257, version=30795,

count=1, id=96, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=9, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=515, id=1, productName=Unmarked objects,

count=90, id=265, version=34123,

count=1, id=255, version=34123,

count=1, id=151,

count=1, id=258, version=34123,