Themida research

Themida is a software protector from Oreans Technologies that makes Windows programs hard to analyze and modify. The vendor's documentation describes Themida as built to protect applications against reverse engineering and software cracking with its SecureEngine protection system, and Oreans' product comparison lists protection for 32-bit and 64-bit Windows programs and DLLs.

Themida supports most programming languages, including C and C++, Delphi, Visual Basic and .NET languages. It can protect .NET executables but not .NET DLLs, and Oreans says its .NET protection is weaker than its native protection, partly because Themida's virtualization and mutation macros are not available for .NET.

Themida is used to keep a program's code from being studied or changed. Oreans names three jobs for it: protecting a program against modification and piracy, against reverse engineering, and against tools that monitor its file and registry activity.

Malware authors use the same protection to hide what their code does from analysts and antivirus products. A Themida file is neither legitimate nor malicious by default; the protection only shows that someone wanted the code to be hard to read.

Themida protects a program at two levels: the whole file, and selected blocks of code inside it. At the file level, Themida encrypts and compresses the program and its resources and adds a protection loader that runs first: it checks for debuggers and monitoring tools, then decrypts the program and hands over control. At the code level, Themida translates the selected blocks into instructions for a virtual machine that it builds into the file.

Developers choose the code to virtualize by marking it in the source with macros such as VM_TIGER_WHITE_START and VM_TIGER_WHITE_END, or by selecting functions from a MAP or PDB file. When the program reaches a marked block, SecureEngine emulates it with virtual opcodes that only its own virtual machine understands, so a disassembler finds the virtual machine and its opcodes instead of the original instructions.

Themida's virtual machines come in several architectures named after animals, such as FISH, TIGER, PUMA, SHARK, DOLPHIN, EAGLE and LION, some in lighter and heavier variants. Oreans compares the difference between two architectures, such as TIGER and LION, to the difference between an x86 and an ARM processor. Each time a program is protected, it also gets its own instance of every architecture it uses, with different registers, handlers and opcode table, so two protected copies of the same program share only the architecture's internal design.

Virtualized code runs more slowly than native code. Oreans recommends a lighter virtual machine, such as FISH or TIGER, for code that has to run fast, a heavier one, such as PUMA or SHARK, for the most sensitive code, and keeping tight loops with many iterations out of virtualized code.

Themida can also mutate code instead of virtualizing it. The MUTATE macro turns the original x86 instructions into equivalent but more complex x86 instructions, which run faster than virtualized code but protect it less. Further options include API wrapping that hides which Windows APIs a program uses, string encryption, checks against patching, and detection of sandboxes and of virtual environments such as VMware and VirtualBox.

Removing the file-level protection does not undo the code-level protection. Virtualized code stays as virtual opcodes that Themida's virtual machine emulates each time the code runs, which is why unpacking a Themida file does not make its virtualized functions readable. The guide on why unpacking is not devirtualization compares the three jobs side by side.

Oreans sells Themida alongside Code Virtualizer. Both virtualize and mutate code; they differ in the files they protect and in the protection they add around that code.

Code Virtualizer covers more platforms and processors, but protects only the code a developer marks. Themida also protects the program as a whole.

Themida itself is not malware: it is a commercial protector that software developers license from Oreans. Malware authors use it too, though, so antivirus products treat Themida files with suspicion. Malwarebytes, for example, uses Trojan.MalPack.Themida as its generic detection name for trojans protected with Themida.

MITRE ATT&CK lists eight threat groups, malware families and campaigns that packed code with Themida, among them APT38, APT41 and Lazarus Group's Operation Dream Job. Oreans acknowledges the effect in its own documentation: because malware writers use software protectors to hide from antivirus products, antivirus companies are stricter with packed files, and legitimate Themida programs are sometimes reported as false positives.

The Themida part of a detection name identifies the protector, not what the program does. Finding out what a protected file does takes analysis of the file itself, which is what Devirt's malware analysis service provides for protected and ordinary samples.