What is “Win32/Packed.Themida.HRI”?

Malware Removal

The Win32/Packed.Themida.HRI is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware - Review 2020

GridinSoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend to use GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the TRIAL period.
6-day free trial available.

What Win32/Packed.Themida.HRI virus can do?

  • Presents an Authenticode digital signature
  • Creates RWX memory
  • The binary likely contains encrypted or compressed data.
  • Checks for the presence of known windows from debuggers and forensic tools
  • Tries to unhook or modify Windows functions monitored by Cuckoo
  • Network activity detected but not expressed in API logs
  • Checks the version of Bios, possibly for anti-virtualization
  • Detects VirtualBox through the presence of a registry key
  • Anomalous binary characteristics

Related domains:

z.whorecord.xyz
a.tomx.xyz

How to determine Win32/Packed.Themida.HRI?


File Info:

crc32: 8A46D7F7
md5: 281a738df4052f3f97ed7a9c22f04250
name: 281A738DF4052F3F97ED7A9C22F04250.mlw
sha1: cadf0a3ddee3e6c9e77f6d8088f4a2268e2ff6cc
sha256: f10b8817b388868aa1e76c8f706dd0bedda991ff21c397be125d617280153561
sha512: a3525a0c5c7e72b801737441d9b5b3f0be90b8a0aca0129ce2e8352d4cb205272db1084aba3768b8deda708bd5404afd8acc53eb30f52bffb1f863a87e1c5115
ssdeep: 49152:pyNdZTL/QBU1UrLxIPKceEKd0vXX7SoQ6+T+qbL2mG5O7+Pe1tANXL5pYAVZ:UNdZTDsUCH6KN5mvWoWT+wLLGHctgvL
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

Translation: 0x0000 0x04b0
LegalCopyright: Copyright (c) iZSEcDETBb76bVZ 2020
Assembly Version: 9.7.3.8
InternalName: Loader.exe
FileVersion: 1.1.8.9
CompanyName: Paragon
Comments: kn6p3raejiB_BMU
ProductName: Sysinternals Procmon
ProductVersion: 1.1.8.9
FileDescription: 8_Xn2YM92vaLR6z
OriginalFilename: Loader.exe

Win32/Packed.Themida.HRI also known as:

BkavW32.AIDetectGBM.malware.02
Elasticmalicious (high confidence)
FireEyeGeneric.mg.281a738df4052f3f
McAfeeArtemis!281A738DF405
CylanceUnsafe
SangforTrojan.Win32.Save.a
K7AntiVirusTrojan ( 0056043f1 )
BitDefenderTrojan.GenericKDZ.73115
K7GWTrojan ( 0056043f1 )
Cybereasonmalicious.ddee3e
BitDefenderThetaGen:NN.ZexaCO.34574.DE2@a0xchtdi
APEXMalicious
CynetMalicious (score: 100)
NANO-AntivirusVirus.Win32.Gen-Crypt.ccnc
MicroWorld-eScanTrojan.GenericKDZ.73115
Ad-AwareTrojan.GenericKDZ.73115
SophosML/PE-A
McAfee-GW-EditionArtemis!Trojan
EmsisoftTrojan.GenericKDZ.73115 (B)
GDataTrojan.GenericKDZ.73115
JiangminTrojan.PSW.Predator.bfh
MAXmalware (ai score=84)
GridinsoftTrojan.Heur!.012120B1
ArcabitTrojan.Generic.D11D9B
MicrosoftTrojan:Win32/Wacatac.B!ml
VBA32BScope.TrojanPSW.Agent
MalwarebytesMalware.Heuristic.1003
ESET-NOD32a variant of Win32/Packed.Themida.HRI
RisingTrojan.Generic@ML.97 (RDML:rEcSCvRyHH+w48fk4nSbcg)
YandexTrojan.TPM!h27aFNnrhko
IkarusTrojan.Win64.Themida
eGambitPE.Heur.InvalidSig
Qihoo-360HEUR/QVM19.1.79A8.Malware.Gen

How to remove Win32/Packed.Themida.HRI?

Win32/Packed.Themida.HRI removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

Leave a Comment