2

I used PEiD & Stud_PE to get the packer/encrypter signature but unfortunately they didn't detect it.

enter image description here

could someone help with this issue?

EDIT: As @beatcracker said in comments, using ExeinfoPe says: enter image description here

  • 1
    Looks like the section names are randomly generated. Try to feed this file to Exeinfo PE. – beatcracker Dec 13 '15 at 17:18
  • 3
    Unwrapper for GOTD installers: UnWrapper GOTD V2 Saves the Latest Giveawayoftheday Setup Files – beatcracker Dec 13 '15 at 18:46
  • @beatcracker: it's not a Giveawayoftheday Setup File as the unpacker said, thank you for your help, my question is: is there a native exe unpacker for Themida ? – M. Abdelhafid Dec 13 '15 at 18:59
  • 3
    Themida is very hard to unpack (even the new driverless versions), there is a ton of protections options that can be enabled (see manual), so I doubt that there is a generic unpacker in the wild. Try this tutotial: How Unpack Themida 2.x.x – beatcracker Dec 13 '15 at 19:23
  • @beatcracker: it worked like a charm, you have to change your comment into a valid answer – M. Abdelhafid Dec 14 '15 at 8:43
3

I used PEiD & Stud_PE to get the packer/encrypter signature but unfortunately they didn't detect it.

Exeinfo PE has more recent signatures (beware of gifs, though).

EDIT: As @beatcracker said in comments, using ExeinfoPe says:

Detected Themida v2.x Inside, Themida Code on Section.

Is there a native exe unpacker for Themida ?

Themida is very hard to unpack (even the new driverless versions), there is a ton of protections options that can be enabled (see manual), so I doubt that there is a generic unpacker in the wild.

Try this tutotial: How Unpack Themida 2.x.x. It uses OllyDbg script which hides most of the complexity required to unpack\fix Themida.

References:

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.