4d8f1df95355be6be65bd8d083c60b9f53eb25ab6f027a88c092d45b625dd0fe

Sharing

Copy URL Twitter E-mail

General

Target
4d8f1df95355be6be65bd8d083c60b9f53eb25ab6f027a88c092d45b625dd0fe
Size 15.8MB
Sample260818-p16hqsseqg
SHA256 4d8f1df95355be6be65bd8d083c60b9f53eb25ab6f027a88c092d45b625dd0fe
MD5 48b1d6410b136ebbd3f018c9d2d47612
SHA1 c1e9ab90adb14f67eb08daed56b48e512714d08a
SHA512 002e0ecb0643e9c6d012f7dbb708b10ed149ebbda1abb6d8ef12324fb65e3bd5a2d726df2be4ae613a5bd0a1f31deceb9731a075c850ca3478c40be8093d23dd
SSDEEP 196608:5sbGONTq5f3DE85WuYUMvHu6npZ902IHVl3tosf8KNaakLIT9SJbtgaxLMU4:9uqBTF0uYUeHu662YVFqMYV54
TLSH
T10FF6F17EB54168CFD16A1B3A7483EE2A5E1943AB05704C03D5DBB83F6F5AE01B781A34
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4d8f1df95355be6be65bd8d083c60b9f53eb25ab6f027a88c092d45b625dd0fe

File Explorer

4d8f1df95355be6be65bd8d083c60b9f53eb25ab6f027a88c092d45b625dd0fe

.exe 15.8MB

4d8f1df95355be6be65bd8d083c60b9f53eb25ab6f027a88c092d45b625dd0fe

SHA256 4d8f1df95355be6be65bd8d083c60b9f53eb25ab6f027a88c092d45b625dd0fe
MD5 48b1d6410b136ebbd3f018c9d2d47612
SHA1 c1e9ab90adb14f67eb08daed56b48e512714d08a
SHA512 002e0ecb0643e9c6d012f7dbb708b10ed149ebbda1abb6d8ef12324fb65e3bd5a2d726df2be4ae613a5bd0a1f31deceb9731a075c850ca3478c40be8093d23dd
SSDEEP 196608:5sbGONTq5f3DE85WuYUMvHu6npZ902IHVl3tosf8KNaakLIT9SJbtgaxLMU4:9uqBTF0uYUeHu662YVFqMYV54
TLSH
T10FF6F17EB54168CFD16A1B3A7483EE2A5E1943AB05704C03D5DBB83F6F5AE01B781A34
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14139480

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

849KB

Virtual Size

852KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

392KB

Virtual Size

744KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

3.2MB

Virtual Size

3.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.edata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vm_sec

Size

7KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

163KB

Virtual Size

164KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

4.3MB

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

2.6MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

4d8f1df95355be6be65bd8d083c60b9f53eb25ab6f027a88c092d45b625dd0fe

generic