Categories: Malware

Win32/Packed.Themida.HLD malicious file

The Win32/Packed.Themida.HLD is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Packed.Themida.HLD virus can do?

Executable code extraction
Presents an Authenticode digital signature
Creates RWX memory
The binary likely contains encrypted or compressed data.
Detects Sandboxie through the presence of a library
Checks for the presence of known windows from debuggers and forensic tools
Tries to unhook or modify Windows functions monitored by Cuckoo
Network activity detected but not expressed in API logs
Checks the version of Bios, possibly for anti-virtualization
Detects VirtualBox through the presence of a registry key
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

How to determine Win32/Packed.Themida.HLD?


File Info:
crc32: 0A560AD7md5: 2e79c294ea08893a76c2f98ca04fc7e2name: 1500.exesha1: 056e24004ad7ae0216878ec7fda7eeff15ababc1sha256: 6f133c20cf741406f168c428864e4b277913cf88c958368f8170a80b075c952asha512: cfe3da74e1f9c83c4a2d09304ea965bbd5883c4cc181fbeeda5bd8aaa5c4b711bf522f595e3a7f765facf385edb2dfe780ef18c6e0710340a75711dd99031226ssdeep: 49152:hc0La9ZvVk8C61IeXu9hsu4biugrFA2ncH9pUKnfWlxg:hdLa9Ze8C6JeZ4baXeznfYgtype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
LegalCopyright: Copyright  Microsoft 2017Assembly Version: 1.0.0.0InternalName: oAJRXDqlPqtsVJZiwqH.exeFileVersion: 1.0.0.0CompanyName: MicrosoftLegalTrademarks: Comments: ProductName: SmartWinFormProductVersion: 1.0.0.0FileDescription: SmartWinFormOriginalFilename: oAJRXDqlPqtsVJZiwqH.exeTranslation: 0x0000 0x04b0

Win32/Packed.Themida.HLD also known as:

Bkav	W32.HfsAutoB.
MicroWorld-eScan	Trojan.GenericKD.33730546
Qihoo-360	Generic/Trojan.PSW.cf8
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
AegisLab	Trojan.MSIL.Reline.i!c
Sangfor	Malware
BitDefender	Trojan.GenericKD.33730546
Cybereason	malicious.04ad7a
Invincea	heuristic
BitDefenderTheta	Gen:NN.ZexaF.34108.SD1@amKq8Tpi
Symantec	ML.Attribute.HighConfidence
Paloalto	generic.ml
GData	Trojan.GenericKD.33730546
Kaspersky	Trojan-PSW.MSIL.Reline.au
Alibaba	TrojanPSW:MSIL/Reline.4a9b282f
NANO-Antivirus	Virus.Win32.Gen-Crypt.ccnc
Tencent	Msil.Trojan-qqpass.Qqrob.Htwj
Ad-Aware	Trojan.GenericKD.33730546
Sophos	Mal/Generic-S
Comodo	Malware@#1bxeha0fdbcr9
F-Secure	Trojan.TR/RedCap.vmeat
McAfee-GW-Edition	Artemis!Trojan
SentinelOne	DFI – Suspicious PE
Trapmine	malicious.high.ml.score
Emsisoft	Trojan.GenericKD.33730546 (B)
APEX	Malicious
Webroot	W32.Malware.Gen
Avira	TR/RedCap.vmeat
Antiy-AVL	Trojan/Win32.Wacatac
Endgame	malicious (high confidence)
Arcabit	Trojan.Generic.D202AFF2
ZoneAlarm	Trojan-PSW.MSIL.Reline.au
Microsoft	Trojan:Win32/Bluteal!rfn
Acronis	suspicious
McAfee	GenericRXKI-DI!2E79C294EA08
MAX	malware (ai score=99)
VBA32	BScope.Trojan.Wacatac
ESET-NOD32	a variant of Win32/Packed.Themida.HLD
Rising	Stealer.Baldr!1.B723 (CLASSIC)
Ikarus	Trojan.MSIL.Spy
eGambit	Unsafe.AI_Score_99%
Fortinet	W32/Reline.AU!tr.pws
AVG	FileRepMalware
CrowdStrike	win/malicious_confidence_80% (W)