7788389325c248982f12f85fb57d62b7f3b702e87ac1e371c5544a6e7b8262b6

Sharing

Copy URL Twitter E-mail

General

Target
7788389325c248982f12f85fb57d62b7f3b702e87ac1e371c5544a6e7b8262b6
Size 5.6MB
Sample260831-ff1mbaxthy
SHA256 7788389325c248982f12f85fb57d62b7f3b702e87ac1e371c5544a6e7b8262b6
MD5 c9dc59e8d8bba459569bc9cc1c41b694
SHA1 783922d7b883e0db11d8517a7fb102dd7f97b635
SHA512 b67c5e55e59215ae77ab23d1210718814af6950cde09c7ebc4634284e3b28b5af787300d0f00e99c18927aae4c513fd30f359a3f2393885ca131a85555654c25
SSDEEP 98304:jy7vvA9aGCvw75lA2IoFjO4NEGL+6TiIQ9ydEZrn+98bs0dzTyy4JWrfirq9fAz:jyLPGg2vjjEL6mN9ydEZTKAt54JWrfij
TLSH
T1A15633679963BBB7F08B3CF00D66452654D6165D5EEC40BC35805220EF24AEFB7291F8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7788389325c248982f12f85fb57d62b7f3b702e87ac1e371c5544a6e7b8262b6

File Explorer

7788389325c248982f12f85fb57d62b7f3b702e87ac1e371c5544a6e7b8262b6

.exe 5.6MB

7788389325c248982f12f85fb57d62b7f3b702e87ac1e371c5544a6e7b8262b6

SHA256 7788389325c248982f12f85fb57d62b7f3b702e87ac1e371c5544a6e7b8262b6
MD5 c9dc59e8d8bba459569bc9cc1c41b694
SHA1 783922d7b883e0db11d8517a7fb102dd7f97b635
SHA512 b67c5e55e59215ae77ab23d1210718814af6950cde09c7ebc4634284e3b28b5af787300d0f00e99c18927aae4c513fd30f359a3f2393885ca131a85555654c25
SSDEEP 98304:jy7vvA9aGCvw75lA2IoFjO4NEGL+6TiIQ9ydEZrn+98bs0dzTyy4JWrfirq9fAz:jyLPGg2vjjEL6mN9ydEZTKAt54JWrfij
TLSH
T1A15633679963BBB7F08B3CF00D66452654D6165D5EEC40BC35805220EF24AEFB7291F8
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9506904

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

Size

95KB

Virtual Size

185KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

19KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

1024B

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

7KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.idata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.themida

Size

Virtual Size

8.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

5.5MB

Virtual Size

5.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

16B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

7788389325c248982f12f85fb57d62b7f3b702e87ac1e371c5544a6e7b8262b6

generic