7cb0d60ed80748425525063f672f1cc0d9d75f9a0adaec52686833167ecfc8dd

General

Target
7cb0d60ed80748425525063f672f1cc0d9d75f9a0adaec52686833167ecfc8dd
Size 1.3MB
Sample261006-rxjkxahy21
SHA256 7cb0d60ed80748425525063f672f1cc0d9d75f9a0adaec52686833167ecfc8dd
MD5 2239e984fbaf68d659f6a14aa445d251
SHA1 95133e8198ca967dbea11d0b660cd89ecb1f4601
SHA512 6859c7c6de41744471b0b2b64eb9f6629842ae5ec803fea00e63c6cb1aa61965906604370ba73937a2e5b1c7b1e093e97625f43f1e8c60dc248174bbad30353b
SSDEEP 24576:bh9UDX6t25QVYGTxtm0+Z3EV/ho6Vn7E13Q5tv4wyqaE:7Ub6t2L4Hm0YItVM3Q5H/L
TLSH
T1E15533ECC42F7CD5C51FB1B2F7EE86372B427D9A848572AC63D90102E8962B35391B49
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7cb0d60ed80748425525063f672f1cc0d9d75f9a0adaec52686833167ecfc8dd

File Explorer

7cb0d60ed80748425525063f672f1cc0d9d75f9a0adaec52686833167ecfc8dd

.exe 1.3MB

7cb0d60ed80748425525063f672f1cc0d9d75f9a0adaec52686833167ecfc8dd

SHA256 7cb0d60ed80748425525063f672f1cc0d9d75f9a0adaec52686833167ecfc8dd
MD5 2239e984fbaf68d659f6a14aa445d251
SHA1 95133e8198ca967dbea11d0b660cd89ecb1f4601
SHA512 6859c7c6de41744471b0b2b64eb9f6629842ae5ec803fea00e63c6cb1aa61965906604370ba73937a2e5b1c7b1e093e97625f43f1e8c60dc248174bbad30353b
SSDEEP 24576:bh9UDX6t25QVYGTxtm0+Z3EV/ho6Vn7E13Q5tv4wyqaE:7Ub6t2L4Hm0YItVM3Q5H/L
TLSH
T1E15533ECC42F7CD5C51FB1B2F7EE86372B427D9A848572AC63D90102E8962B35391B49
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

2805848

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

Size

31KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

3KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.themida

Size

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

7cb0d60ed80748425525063f672f1cc0d9d75f9a0adaec52686833167ecfc8dd

generic