75d8cb658d7e67754941d0540e3f03c8a16027130ac417d06f333780bc37adae

Sharing

Copy URL Twitter E-mail

General

Target
75d8cb658d7e67754941d0540e3f03c8a16027130ac417d06f333780bc37adae
Size 4.7MB
Sample260825-qts5hashph
SHA256 75d8cb658d7e67754941d0540e3f03c8a16027130ac417d06f333780bc37adae
MD5 6598ee0afbad1ab51a9ffe26f670404a
SHA1 5f06f2a85b78a1dd696204555d6f9d3622588bfd
SHA512 6b30b3c07b0c5b29ac5b6abf606f116faed7259ce89dbb70a3a842ecca41ded6b17096380604f062edff9df584ccca8e6a71057f4175651c3cb08975dd4b0737
SSDEEP 98304:3dRAWSH6aEBSGZu5uqk0vCqxYkiOWt631fQoDR0YGXD3R:3TNSbEktAj3kpWt631fnQXD3
TLSH
T1AE3633F0C5132FBDFC409B310085A928A1BE2F94E56B81BD4B5535373AFB2429E627D6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
75d8cb658d7e67754941d0540e3f03c8a16027130ac417d06f333780bc37adae

File Explorer

75d8cb658d7e67754941d0540e3f03c8a16027130ac417d06f333780bc37adae

.exe 4.7MB

75d8cb658d7e67754941d0540e3f03c8a16027130ac417d06f333780bc37adae

SHA256 75d8cb658d7e67754941d0540e3f03c8a16027130ac417d06f333780bc37adae
MD5 6598ee0afbad1ab51a9ffe26f670404a
SHA1 5f06f2a85b78a1dd696204555d6f9d3622588bfd
SHA512 6b30b3c07b0c5b29ac5b6abf606f116faed7259ce89dbb70a3a842ecca41ded6b17096380604f062edff9df584ccca8e6a71057f4175651c3cb08975dd4b0737
SSDEEP 98304:3dRAWSH6aEBSGZu5uqk0vCqxYkiOWt631fQoDR0YGXD3R:3TNSbEktAj3kpWt631fnQXD3
TLSH
T1AE3633F0C5132FBDFC409B310085A928A1BE2F94E56B81BD4B5535373AFB2429E627D6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11763712

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

Size

1.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

204KB

Virtual Size

448KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

464KB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

36KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

Virtual Size

4.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

\JuZ�u�

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=3, id=11, version=8798,

count=9, id=11, version=8047,

count=6, id=10, version=8047,

count=14, id=12, version=7291,

count=2, id=93, version=2179,

count=7, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=1, id=11, version=8966,

count=84, id=10, version=8966,

count=50, id=14, version=7299,

count=880, id=1, productName=Unmarked objects,

count=41, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=227, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=123, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=149, id=11, productName=VS98 (6.0) build 8168, version=8168,

count=50, id=10, productName=VS98 (6.0) build 8168, version=8168,

count=1, productName=Unmarked objects (old),

count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,