f59c294761bfd92ddcd8a580a82af4e8f993041a71039965b188d43c26b8e80c

Sharing

Copy URL Twitter E-mail

General

Target
f59c294761bfd92ddcd8a580a82af4e8f993041a71039965b188d43c26b8e80c
Size 3.7MB
Sample260810-mdfmpafd98
SHA256 f59c294761bfd92ddcd8a580a82af4e8f993041a71039965b188d43c26b8e80c
MD5 6710b2d79d59ab5fd10473eea62ac901
SHA1 422d9f3421360815762e2d117e9c43492d6f1969
SHA512 2f66608b962c5f292ce460cdffc35df38875ba19a10d950a405a51f906e300ab7e8cb1f7c6743865d6da94423d52b36d74c57fa8cdaf311c154203c21f0e149b
SSDEEP 98304:G4UbX6H7BO77VypkUhFI8eVgmLT3KMtASn5T:Gp+H7GVypkU67gmLTaqAI
TLSH
T1F30633D392624CC1C614CFB1A279518A8C6EF3224A3F19A54D2F11DB9C8FE5CAFB1197
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f59c294761bfd92ddcd8a580a82af4e8f993041a71039965b188d43c26b8e80c

File Explorer

f59c294761bfd92ddcd8a580a82af4e8f993041a71039965b188d43c26b8e80c

.exe 3.7MB

f59c294761bfd92ddcd8a580a82af4e8f993041a71039965b188d43c26b8e80c

SHA256 f59c294761bfd92ddcd8a580a82af4e8f993041a71039965b188d43c26b8e80c
MD5 6710b2d79d59ab5fd10473eea62ac901
SHA1 422d9f3421360815762e2d117e9c43492d6f1969
SHA512 2f66608b962c5f292ce460cdffc35df38875ba19a10d950a405a51f906e300ab7e8cb1f7c6743865d6da94423d52b36d74c57fa8cdaf311c154203c21f0e149b
SSDEEP 98304:G4UbX6H7BO77VypkUhFI8eVgmLT3KMtASn5T:Gp+H7GVypkU67gmLTaqAI
TLSH
T1F30633D392624CC1C614CFB1A279518A8C6EF3224A3F19A54D2F11DB9C8FE5CAFB1197
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

248107184

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

Size

563KB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

50KB

Virtual Size

140KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

36KB

Virtual Size

230.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

7KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

88KB

Virtual Size

110KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

Virtual Size

4.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

16B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ

generic

count=7, id=170, productName=VS2010 build 30319, version=30319,

count=104, id=260, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=1, id=263, version=30795,

count=4, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=11, id=253, version=33808,

count=9, id=259, version=33808,

count=12, id=260, version=33808,

count=34, id=261, version=33808,

count=4, id=257, version=33808,

count=2, id=156, productName=VS2010 build 30319, version=30319,

count=2, id=11, version=8447,

count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=32, id=257, version=30795,

count=1, id=96, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=9, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=515, id=1, productName=Unmarked objects,

count=90, id=265, version=34123,

count=1, id=255, version=34123,

count=1, id=151,

count=1, id=258, version=34123,