cc9eb9c26aa4a1fff66b08dda350dd2894e3c3547e906886d01f0fea36a41ac9

Sharing

Copy URL Twitter E-mail

General

Target
cc9eb9c26aa4a1fff66b08dda350dd2894e3c3547e906886d01f0fea36a41ac9
Size 10.3MB
Sample261023-asfvsaa19p
SHA256 cc9eb9c26aa4a1fff66b08dda350dd2894e3c3547e906886d01f0fea36a41ac9
MD5 7d5bd4c8ed55beafff6617222530879d
SHA1 2d0f69e14cf0c057b2871239cbfcfb8c99687983
SHA512 f54b58b3c6596cbf704754531779abcc8e5f014bcb54ef14f9eaca561673583e090eaa00f03558337597d87a3713443f0a77e5de553a1ec9342b4b6ab8839774
SSDEEP 196608:xQ2HUwJ13nXkzBmDrfs3ELOiP8rRcN98laeDBwpe8SW8:xQ2HvJ1XXOmPACkqN2wptS
TLSH
T117B6333BA2C03DD7E1BA63F02E1254108AB0FDB76A868575F16F83918D1A25DEF36351
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cc9eb9c26aa4a1fff66b08dda350dd2894e3c3547e906886d01f0fea36a41ac9

File Explorer

cc9eb9c26aa4a1fff66b08dda350dd2894e3c3547e906886d01f0fea36a41ac9

.exe 10.3MB

cc9eb9c26aa4a1fff66b08dda350dd2894e3c3547e906886d01f0fea36a41ac9

SHA256 cc9eb9c26aa4a1fff66b08dda350dd2894e3c3547e906886d01f0fea36a41ac9
MD5 7d5bd4c8ed55beafff6617222530879d
SHA1 2d0f69e14cf0c057b2871239cbfcfb8c99687983
SHA512 f54b58b3c6596cbf704754531779abcc8e5f014bcb54ef14f9eaca561673583e090eaa00f03558337597d87a3713443f0a77e5de553a1ec9342b4b6ab8839774
SSDEEP 196608:xQ2HUwJ13nXkzBmDrfs3ELOiP8rRcN98laeDBwpe8SW8:xQ2HvJ1XXOmPACkqN2wptS
TLSH
T117B6333BA2C03DD7E1BA63F02E1254108AB0FDB76A868575F16F83918D1A25DEF36351
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

56590424

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

Size

2.3MB

Virtual Size

6.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

3.6MB

Virtual Size

8.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

356KB

Virtual Size

33.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

75KB

Virtual Size

154KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

53KB

Virtual Size

145KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_READ

Name

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

Virtual Size

6.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

4.0MB

Virtual Size

4.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

cc9eb9c26aa4a1fff66b08dda350dd2894e3c3547e906886d01f0fea36a41ac9

generic