d4a27d916ca5c3e322ee82bdb883c4485dde3a22f6e80257cef7033be87c5df0

Sharing

Copy URL Twitter E-mail

General

Target
d4a27d916ca5c3e322ee82bdb883c4485dde3a22f6e80257cef7033be87c5df0
Size 6.7MB
Sample260812-rh24psyepc
SHA256 d4a27d916ca5c3e322ee82bdb883c4485dde3a22f6e80257cef7033be87c5df0
MD5 d6722bb268d12c8d1d4ecc4f40e5fa8f
SHA1 291cba885885d456fefe5143b3f8246f7c64cc16
SHA512 527cd9b64b077fe710a09cc56ed3d58f17973afc47ae188b7a6083e1337daf7465f6306c5fe5f313440fa34cfb813cd0ad9c18bacdac3ccab922ac48ef353cbf
SSDEEP 196608:LOkYXXUkpxvwMTTHuYehoFAJUJgHhZ6cq:arXlxvhOhhoKHe
TLSH
T10F66331BDDCB127CE6156DB7EAA1F01E22793272A010151A81D643CB0B075DCBAED9FB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
static1/unpack001/641a0f4066850e5f342d94f74b29eaf19a6fdd6359a2e4e2b12b22031c184da1.exe	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/641a0f4066850e5f342d94f74b29eaf19a6fdd6359a2e4e2b12b22031c184da1.exe

File Explorer

d4a27d916ca5c3e322ee82bdb883c4485dde3a22f6e80257cef7033be87c5df0

.zip 6.7MB
641a0f4066850e5f342d94f74b29eaf19a6fdd6359a2e4e2b12b22031c184da1.exe

.exe 10.0MB

d4a27d916ca5c3e322ee82bdb883c4485dde3a22f6e80257cef7033be87c5df0

SHA256 d4a27d916ca5c3e322ee82bdb883c4485dde3a22f6e80257cef7033be87c5df0
MD5 d6722bb268d12c8d1d4ecc4f40e5fa8f
SHA1 291cba885885d456fefe5143b3f8246f7c64cc16
SHA512 527cd9b64b077fe710a09cc56ed3d58f17973afc47ae188b7a6083e1337daf7465f6306c5fe5f313440fa34cfb813cd0ad9c18bacdac3ccab922ac48ef353cbf
SSDEEP 196608:LOkYXXUkpxvwMTTHuYehoFAJUJgHhZ6cq:arXlxvhOhhoKHe
TLSH
T10F66331BDDCB127CE6156DB7EAA1F01E22793272A010151A81D643CB0B075DCBAED9FB
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

641a0f4066850e5f342d94f74b29eaf19a6fdd6359a2e4e2b12b22031c184da1.exe

SHA256 641a0f4066850e5f342d94f74b29eaf19a6fdd6359a2e4e2b12b22031c184da1
MD5 edc780e744052dc0e0034b7774414bba
SHA1 5ef5832db693cd763771010e9fdd07151b819519
SHA512 49c45264847a6abae6841f0a1eb249294f78fe80096243ed47f3081f3313dacc760a0b0811590f6287bdde756f5c6575f5b16544e5c0832f0edfe5375943a11c
SSDEEP 196608:Tz5E4hukpZNFKNxZK/rAkiy/+/VMx8YIyzabNcMlC:TlE4hukpFyxAfmWx8YIaab+M
TLSH
T103B68CA1B909A3CFD46B0A7494C3DD135B6D13F581194B06D92CF4BABD63C423B8BA78
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6938712

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

95KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

40KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.idata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.themida

Size

Virtual Size

6.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

3.4MB

Virtual Size

3.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

d4a27d916ca5c3e322ee82bdb883c4485dde3a22f6e80257cef7033be87c5df0

641a0f4066850e5f342d94f74b29eaf19a6fdd6359a2e4e2b12b22031c184da1.exe

generic