I'm working in a large SOC and my manager has tasked me with finding some way to provide coverage for Themida packed malware samples.

As alluring as it is to suggest just blacklisting all Themida packed software and calling it a day, I would like to do my due diligence before I take that approach.

I noticed that Themida claims to digitally watermark their executables to protect against piracy, and copies of the software are available for torrent on many pirate sites. I was wondering whether the software left the watermark on the packed executables, and whether the pirated software leaves a watermark on the packed binaries that could be signed against.

I know that this is a thing based off of the answer to this post: https://reverseengineering.stackexchange.com/questions/1478/how-common-are-virtualized-packers-in-the-wild/1479#1479, but the person who answered provided sources for all of his other claims besides this one.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.