456729a9e581d6b898cee30df508a7ffb2cc651a1374095ad997daa92b5dce65

Sharing

Copy URL

Twitter E-mail

General

Target

456729a9e581d6b898cee30df508a7ffb2cc651a1374095ad997daa92b5dce65
Size

8.0MB
MD5

d6bb5bbd20581612e3672d5e3f8e1cc1
SHA1

97f2cda4f530bcc1fddfe3f27e3f782d01069a7e
SHA256

456729a9e581d6b898cee30df508a7ffb2cc651a1374095ad997daa92b5dce65
SHA512

dc875db4548bfc2d743eb524a8cb1bfde0d43434a54ced69c38918943d485ea6a11a4baca85018b65da44bfb9660f0238d40bb6a41ba6152f996d0eb808919cf
SSDEEP

196608:r44aLt3avhwgwmBFpvwuH2PSgsB/wqDIK+t1ibKMnaO6lzrg7Rj:r4nx3avSZmBF9FBjDIK+t1AnaO69rARj

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs
Detects Themida, an advanced Windows software protection system.
themida

Processes:

resource yara_rule

sample themida

resource	yara_rule
sample	themida

Files

456729a9e581d6b898cee30df508a7ffb2cc651a1374095ad997daa92b5dce65
.exe windows x64

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:ba:86:ab:56:10:7e:6c:e3:27:15:aa:11:9b:fd:97
Certificate

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

31-03-2020 00:00

Not After

28-07-2022 12:00

Subject

SERIALNUMBER=559077-6752,CN=Int3 Software AB,O=Int3 Software AB,L=Gothenburg,C=SE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025345

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:27:2c:0e:c0:54:83:c8:03:bf:1c:15:bc:1f:3c:80
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-04-2020 00:00

Not After

28-07-2022 12:00

Subject

SERIALNUMBER=559077-6752,CN=Int3 Software AB,O=Int3 Software AB,L=Gothenburg,C=SE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025345

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:81:92:5a:ca:19:b7:bd:4e:2e:8d:85:4e:a7:42:05:7d:2c:42:a2:ae:2b:61:2c:6e:6f:d7:06:73:0a:21:5a
Signer

Actual PE Digest

0d:81:92:5a:ca:19:b7:bd:4e:2e:8d:85:4e:a7:42:05:7d:2c:42:a2:ae:2b:61:2c:6e:6f:d7:06:73:0a:21:5a

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=559077-6752,CN=Int3 Software AB,O=Int3 Software AB,L=Gothenburg,C=SE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025345

30-11-2021 13:47
Valid: true

Chain 1

SERIALNUMBER=559077-6752,CN=Int3 Software AB,O=Int3 Software AB,L=Gothenburg,C=SE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025345

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

93:ff:b1:69:69:69:28:6a:41:c2:28:24:66:96:a7:05:ea:de:36:23
Signer

Actual PE Digest

93:ff:b1:69:69:69:28:6a:41:c2:28:24:66:96:a7:05:ea:de:36:23

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=559077-6752,CN=Int3 Software AB,O=Int3 Software AB,L=Gothenburg,C=SE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025345

30-11-2021 13:47
Valid: true

Chain 1

SERIALNUMBER=559077-6752,CN=Int3 Software AB,O=Int3 Software AB,L=Gothenburg,C=SE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025345

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Size: 1.5MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 2.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 22KB - Virtual size: 138KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 72KB - Virtual size: 125KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 3KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 9KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.idata
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 7.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 4.3MB - Virtual size: 4.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 16B - Virtual size: 4KB

IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

01:ba:86:ab:56:10:7e:6c:e3:27:15:aa:11:9b:fd:97Certificate

Extended Key Usages

Key Usages

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06Certificate

Extended Key Usages

Key Usages

07:27:2c:0e:c0:54:83:c8:03:bf:1c:15:bc:1f:3c:80Certificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

0d:81:92:5a:ca:19:b7:bd:4e:2e:8d:85:4e:a7:42:05:7d:2c:42:a2:ae:2b:61:2c:6e:6f:d7:06:73:0a:21:5aSigner

Signature Validations

Verification

30-11-2021 13:47 Valid: true

Chain 1

93:ff:b1:69:69:69:28:6a:41:c2:28:24:66:96:a7:05:ea:de:36:23Signer

Signature Validations

Verification

30-11-2021 13:47 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Sections

Size: 1.5MB - Virtual size: 3.1MB

Size: 2.0MB - Virtual size: 3.0MB

Size: 22KB - Virtual size: 138KB

Size: 72KB - Virtual size: 125KB

Size: 512B - Virtual size: 244B

Size: 3KB - Virtual size: 60KB

Size: 9KB - Virtual size: 32KB

.idata Size: 1KB - Virtual size: 4KB

.tls Size: 5KB - Virtual size: 8KB

.rsrc Size: 60KB - Virtual size: 60KB

.themida Size: - Virtual size: 7.6MB

.boot Size: 4.3MB - Virtual size: 4.3MB

.reloc Size: 16B - Virtual size: 4KB

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

01:ba:86:ab:56:10:7e:6c:e3:27:15:aa:11:9b:fd:97
Certificate

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Certificate

07:27:2c:0e:c0:54:83:c8:03:bf:1c:15:bc:1f:3c:80
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

0d:81:92:5a:ca:19:b7:bd:4e:2e:8d:85:4e:a7:42:05:7d:2c:42:a2:ae:2b:61:2c:6e:6f:d7:06:73:0a:21:5a
Signer

30-11-2021 13:47
Valid: true

93:ff:b1:69:69:69:28:6a:41:c2:28:24:66:96:a7:05:ea:de:36:23
Signer

30-11-2021 13:47
Valid: true

.idata
Size: 1KB - Virtual size: 4KB

.tls
Size: 5KB - Virtual size: 8KB

.rsrc
Size: 60KB - Virtual size: 60KB

.themida
Size: - Virtual size: 7.6MB

.boot
Size: 4.3MB - Virtual size: 4.3MB

.reloc
Size: 16B - Virtual size: 4KB