I'm working in a large SOC and my manager has tasked me with finding some way to provide coverage for Themida packed malware samples.
As alluring as it is to suggest just blacklisting all Themida packed software and calling it a day, I would like to do my due diligence before I take that approach.
I noticed that Themida claims to digitally watermark their executables to protect against piracy, and copies of the software are available for torrent on many pirate sites. I was wondering whether the software left the watermark on the packed executables, and whether the pirated software leaves a watermark on the packed binaries that could be signed against.
I know that this is a thing based off of the answer to this post: https://reverseengineering.stackexchange.com/questions/1478/how-common-are-virtualized-packers-in-the-wild/1479#1479, but the person who answered provided sources for all of his other claims besides this one.