3861d981ea55e042a3aaaef01a0753f7eefc7aea7f84ffcc83c1b69c8ac6ee94

Sharing

Copy URL

Twitter E-mail

General

Target

3861d981ea55e042a3aaaef01a0753f7eefc7aea7f84ffcc83c1b69c8ac6ee94
Size

7.9MB
MD5

6a12088427273b5502f9c2fb46871bf3
SHA1

f60b28e1993e5010a21858edcd5e2da89c6839ee
SHA256

3861d981ea55e042a3aaaef01a0753f7eefc7aea7f84ffcc83c1b69c8ac6ee94
SHA512

295f35a2f0a7eb0af254955e856131824c3874ce0d2359b6b488ccb5034a454b03ecdea13841fe2684653273e9a25467eacfca5e72b649067d4dafd5609a0854
SSDEEP

196608:3SNL/dKnAPX1rwqOJZA8rlhAgzTEMjd1lHl9oHyeM4ih3JSDZrnG:iNpvX18DZhsgUCjtULM5JYNLG

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs
Detects Themida, an advanced Windows software protection system.
themida

Processes:

resource yara_rule

sample themida

resource	yara_rule
sample	themida

Files

3861d981ea55e042a3aaaef01a0753f7eefc7aea7f84ffcc83c1b69c8ac6ee94
.exe windows x64

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:ba:86:ab:56:10:7e:6c:e3:27:15:aa:11:9b:fd:97
Certificate

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

31-03-2020 00:00

Not After

28-07-2022 12:00

Subject

SERIALNUMBER=559077-6752,CN=Int3 Software AB,O=Int3 Software AB,L=Gothenburg,C=SE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025345

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:27:2c:0e:c0:54:83:c8:03:bf:1c:15:bc:1f:3c:80
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-04-2020 00:00

Not After

28-07-2022 12:00

Subject

SERIALNUMBER=559077-6752,CN=Int3 Software AB,O=Int3 Software AB,L=Gothenburg,C=SE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025345

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:59:42:1d:22:c8:c1:2a:3a:c0:fd:05:49:df:90:1f:e2:52:2f:12:18:da:5c:cf:0f:6d:3e:61:dd:84:ab:01
Signer

Actual PE Digest

08:59:42:1d:22:c8:c1:2a:3a:c0:fd:05:49:df:90:1f:e2:52:2f:12:18:da:5c:cf:0f:6d:3e:61:dd:84:ab:01

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=559077-6752,CN=Int3 Software AB,O=Int3 Software AB,L=Gothenburg,C=SE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025345

19-11-2021 07:48
Valid: true

Chain 1

SERIALNUMBER=559077-6752,CN=Int3 Software AB,O=Int3 Software AB,L=Gothenburg,C=SE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025345

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

f1:0e:51:d2:f5:0e:54:ed:68:2b:44:39:69:43:e7:3a:06:b9:90:ff
Signer

Actual PE Digest

f1:0e:51:d2:f5:0e:54:ed:68:2b:44:39:69:43:e7:3a:06:b9:90:ff

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=559077-6752,CN=Int3 Software AB,O=Int3 Software AB,L=Gothenburg,C=SE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025345

19-11-2021 07:48
Valid: true

Chain 1

SERIALNUMBER=559077-6752,CN=Int3 Software AB,O=Int3 Software AB,L=Gothenburg,C=SE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025345

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Size: 1.5MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 2.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 22KB - Virtual size: 138KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 72KB - Virtual size: 125KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 3KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 9KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.idata
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 7.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 4.2MB - Virtual size: 4.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 16B - Virtual size: 4KB

IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

01:ba:86:ab:56:10:7e:6c:e3:27:15:aa:11:9b:fd:97Certificate

Extended Key Usages

Key Usages

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06Certificate

Extended Key Usages

Key Usages

07:27:2c:0e:c0:54:83:c8:03:bf:1c:15:bc:1f:3c:80Certificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

08:59:42:1d:22:c8:c1:2a:3a:c0:fd:05:49:df:90:1f:e2:52:2f:12:18:da:5c:cf:0f:6d:3e:61:dd:84:ab:01Signer

Signature Validations

Verification

19-11-2021 07:48 Valid: true

Chain 1

f1:0e:51:d2:f5:0e:54:ed:68:2b:44:39:69:43:e7:3a:06:b9:90:ffSigner

Signature Validations

Verification

19-11-2021 07:48 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Sections

Size: 1.5MB - Virtual size: 3.1MB

Size: 2.0MB - Virtual size: 3.0MB

Size: 22KB - Virtual size: 138KB

Size: 72KB - Virtual size: 125KB

Size: 512B - Virtual size: 244B

Size: 3KB - Virtual size: 60KB

Size: 9KB - Virtual size: 32KB

.idata Size: 1KB - Virtual size: 4KB

.tls Size: 5KB - Virtual size: 8KB

.rsrc Size: 60KB - Virtual size: 60KB

.themida Size: - Virtual size: 7.6MB

.boot Size: 4.2MB - Virtual size: 4.2MB

.reloc Size: 16B - Virtual size: 4KB

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

01:ba:86:ab:56:10:7e:6c:e3:27:15:aa:11:9b:fd:97
Certificate

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Certificate

07:27:2c:0e:c0:54:83:c8:03:bf:1c:15:bc:1f:3c:80
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

08:59:42:1d:22:c8:c1:2a:3a:c0:fd:05:49:df:90:1f:e2:52:2f:12:18:da:5c:cf:0f:6d:3e:61:dd:84:ab:01
Signer

19-11-2021 07:48
Valid: true

f1:0e:51:d2:f5:0e:54:ed:68:2b:44:39:69:43:e7:3a:06:b9:90:ff
Signer

19-11-2021 07:48
Valid: true

.idata
Size: 1KB - Virtual size: 4KB

.tls
Size: 5KB - Virtual size: 8KB

.rsrc
Size: 60KB - Virtual size: 60KB

.themida
Size: - Virtual size: 7.6MB

.boot
Size: 4.2MB - Virtual size: 4.2MB

.reloc
Size: 16B - Virtual size: 4KB