I used PEiD & Stud_PE to get the packer/encrypter signature but unfortunately they didn't detect it.
could someone help with this issue?
EDIT:
As @beatcracker said in comments, using ExeinfoPe says:
-
1Looks like the section names are randomly generated. Try to feed this file to Exeinfo PE.– beatcrackerCommented Dec 13, 2015 at 17:18
-
3Unwrapper for GOTD installers: UnWrapper GOTD V2 Saves the Latest Giveawayoftheday Setup Files– beatcrackerCommented Dec 13, 2015 at 18:46
-
@beatcracker: it's not a Giveawayoftheday Setup File as the unpacker said, thank you for your help, my question is: is there a native exe unpacker for Themida ?– M. A.Commented Dec 13, 2015 at 18:59
-
3Themida is very hard to unpack (even the new driverless versions), there is a ton of protections options that can be enabled (see manual), so I doubt that there is a generic unpacker in the wild. Try this tutotial: How Unpack Themida 2.x.x– beatcrackerCommented Dec 13, 2015 at 19:23
-
@beatcracker: it worked like a charm, you have to change your comment into a valid answer– M. A.Commented Dec 14, 2015 at 8:43
Add a comment
|
1 Answer
I used PEiD & Stud_PE to get the packer/encrypter signature but unfortunately they didn't detect it.
Exeinfo PE has more recent signatures (beware of gifs, though).
EDIT: As @beatcracker said in comments, using ExeinfoPe says:
Detected Themida v2.x Inside, Themida Code on Section.
Is there a native exe unpacker for Themida ?
Themida is very hard to unpack (even the new driverless versions), there is a ton of protections options that can be enabled (see manual), so I doubt that there is a generic unpacker in the wild.
Try this tutotial: How Unpack Themida 2.x.x. It uses OllyDbg script which hides most of the complexity required to unpack\fix Themida.
References:
- Original link to sript's author post on Tuts4You (requires registration to view)
- Files from the post above (includes video converted to
exe, I've not checked it so be careful): Themida - Winlicense Ultra Unpacker 1.4 - Tutorial.rar - Themida unpacking thread at eXeL@B forums (Russian)
