Win32/Packed.Themida.CID (file analysis)

The Win32/Packed.Themida.CID is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Packed.Themida.CID virus can do?

Executable code extraction
Creates RWX memory
A process attempted to delay the analysis task.
Expresses interest in specific running processes
The binary likely contains encrypted or compressed data.
Checks for the presence of known windows from debuggers and forensic tools
The following process appear to have been packed with Themida: 1.exe
Checks for the presence of known devices from debuggers and forensic tools
Detects the presence of Wine emulator via registry key
Checks the version of Bios, possibly for anti-virtualization
Detects VirtualBox through the presence of a registry key
Attempts to modify proxy settings
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

2no.co

How to determine Win32/Packed.Themida.CID?


File Info:
crc32: 9231A133
md5: 9b22e7b03b9428a9dffd38c791702c9d
name: 1.exe
sha1: 4eab4058dd60da6f08adffbbb2b6175ff53054c6
sha256: 54d88490b96e680dc4149cc43e6c8f9d5fd24e40cbb8533f3c24321aae221f14
sha512: 33c98bfaf852ee2202f5073a9e1e82dce4bd8ca79b5811125372ac035a8799e40f319e563ad9e44627e3b643b3072adb137133fcfd22b9fad127c1dbe9bc5e34
ssdeep: 49152:ZceG93fOK0mva196RZYGchq96K0Xl5c+QNn7XTL:Z5EvdQeZNchCLylhQN7
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: 
InternalName: 
FileVersion: 1.1.28.01
ProductName: 
ProductVersion: 1.1.28.01
FileDescription: 
OriginalFilename: 
Translation: 0x0409 0x04b0

Win32/Packed.Themida.CID also known as:

Bkav	W32.HfsAutoB.
MicroWorld-eScan	Trojan.GenericKD.42705477
FireEye	Generic.mg.9b22e7b03b9428a9
Qihoo-360	Win32/Trojan.PSW.54b
McAfee	Artemis!9B22E7B03B94
Cylance	Unsafe
Sangfor	Malware
K7AntiVirus	Trojan ( 005570471 )
BitDefender	Trojan.GenericKD.42705477
K7GW	Trojan ( 005570471 )
CrowdStrike	win/malicious_confidence_90% (W)
Invincea	heuristic
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Paloalto	generic.ml
GData	Trojan.GenericKD.42705477
Kaspersky	HEUR:Trojan-PSW.Win32.Coins.vho
Alibaba	Packed:Win32/Themida.4cd7a96c
AegisLab	Trojan.Win32.Coins.i!c
Avast	Win32:Trojan-gen
Rising	Malware.Strealer!8.1EF (CLOUD)
Ad-Aware	Trojan.GenericKD.42705477
Sophos	Mal/Generic-S
F-Secure	Heuristic.HEUR/AGEN.1045050
TrendMicro	TROJ_GEN.R057C0WBT20
McAfee-GW-Edition	BehavesLike.Win32.Backdoor.vc
Trapmine	malicious.high.ml.score
Emsisoft	Trojan.GenericKD.42705477 (B)
Ikarus	Trojan-Downloader.Win32.Autohk
Cyren	W32/Trojan.PEHP-0021
Jiangmin	Trojan.PSW.Coins.emx
Avira	HEUR/AGEN.1045050
Endgame	malicious (high confidence)
Arcabit	Trojan.Generic.D28BA245
ZoneAlarm	HEUR:Trojan-PSW.Win32.Coins.vho
Microsoft	Trojan:Win32/Occamy.C
Acronis	suspicious
ALYac	Trojan.GenericKD.42705477
MAX	malware (ai score=85)
Malwarebytes	Trojan.Downloader.AHK.Themida
ESET-NOD32	a variant of Win32/Packed.Themida.CID
TrendMicro-HouseCall	TROJ_GEN.R057C0WBT20
Tencent	Win32.Trojan.Agent.Htlq
SentinelOne	DFI – Malicious PE
eGambit	Unsafe.AI_Score_100%
Fortinet	W32/Coins.VHO!tr.pws
AVG	Win32:Trojan-gen
Cybereason	malicious.8dd60d
Panda	Trj/CI.A
MaxSecure	Trojan.Malware.300983.susgen

How to remove Win32/Packed.Themida.CID?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Win32/Packed.Themida.CID (file analysis)