5779d0b578dc574170d599ee019cba94bc347a0bd315b1be5e32e9d619553992

Sharing

Copy URL

Twitter E-mail

General

Target

5779d0b578dc574170d599ee019cba94bc347a0bd315b1be5e32e9d619553992
Size

2.6MB
MD5

9fea4fe0f1b98649611e2bb0b82e87b9
SHA1

7d247c5f069e73af4875e941e8b41a75e0672310
SHA256

5779d0b578dc574170d599ee019cba94bc347a0bd315b1be5e32e9d619553992
SHA512

7a0ce2da538a3d5564d5540abfff5009891669e44270fffb112e19386af1d3dfc217d47cafc9c6a4e629d55faf4cdad7257ce0dbb574fa5fc3cfaee7f637e049
SSDEEP

49152:PqYGWUlbjpwD9EkazY1FQxUdOqyamR/HuX8xu4JVZf42xh4af7h:PqpR49AYzp4FWGu4JV5rh4af1

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs
Detects Themida, an advanced Windows software protection system.
themida

Processes:

resource yara_rule

sample themida

resource	yara_rule
sample	themida

Files

5779d0b578dc574170d599ee019cba94bc347a0bd315b1be5e32e9d619553992
.exe windows x86

Code Sign

28:53:5f:02:5d:bb:fe:9b:43:cf:f7:3f:f3:0d:28:f9
Certificate

Issuer

CN=Asus SDRW-09D2S-MEX

Not Before

17-11-2021 11:48

Not After

18-11-2031 11:48

Subject

CN=Asus SDRW-09D2S-MEX

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23-10-2020 00:00

Not After

22-01-2032 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

57:23:cc:5a:7a:1f:0d:ed:0c:d4:29:1d:2f:eb:71:e3:62:01:d5:7b:07:63:5f:7d:97:7e:11:e8:f6:02:9e:b6
Signer

Actual PE Digest

57:23:cc:5a:7a:1f:0d:ed:0c:d4:29:1d:2f:eb:71:e3:62:01:d5:7b:07:63:5f:7d:97:7e:11:e8:f6:02:9e:b6

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Asus SDRW-09D2S-MEX

14-02-2022 17:36
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 91KB - Virtual size: 192KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 8KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

® < �
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 4.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

® < �
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 228KB - Virtual size: 228KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

28:53:5f:02:5d:bb:fe:9b:43:cf:f7:3f:f3:0d:28:f9Certificate

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

57:23:cc:5a:7a:1f:0d:ed:0c:d4:29:1d:2f:eb:71:e3:62:01:d5:7b:07:63:5f:7d:97:7e:11:e8:f6:02:9e:b6Signer

Signature Validations

Verification

14-02-2022 17:36 Valid: false

Headers

DLL Characteristics

File Characteristics

Sections

Size: 91KB - Virtual size: 192KB

Size: 8KB - Virtual size: 26KB

Size: 512B - Virtual size: 12B

.idata Size: 512B - Virtual size: 8KB

® < � Size: 3KB - Virtual size: 8KB

.themida Size: - Virtual size: 4.1MB

.boot Size: 2.2MB - Virtual size: 2.2MB

® < � Size: 3KB - Virtual size: 3KB

.rsrc Size: 228KB - Virtual size: 228KB

28:53:5f:02:5d:bb:fe:9b:43:cf:f7:3f:f3:0d:28:f9
Certificate

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

57:23:cc:5a:7a:1f:0d:ed:0c:d4:29:1d:2f:eb:71:e3:62:01:d5:7b:07:63:5f:7d:97:7e:11:e8:f6:02:9e:b6
Signer

14-02-2022 17:36
Valid: false

.idata
Size: 512B - Virtual size: 8KB

® < �
Size: 3KB - Virtual size: 8KB

.themida
Size: - Virtual size: 4.1MB

.boot
Size: 2.2MB - Virtual size: 2.2MB

® < �
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 228KB - Virtual size: 228KB