File[.]bin | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

File.bin
Size

3.6MB
MD5

b90ef112633b9fd8699ca1939991f2c1
SHA1

8789bc4406d047c4fee84f74b64352f3c6eb2274
SHA256

3d3401c3aea61905a7d1bf31b25f7c1910e1fd00aef7e07e253a21c216ffac7a
SHA512

ab0415230607e27d2017d21d65678a1bb0c399da52dc9b64c7126e10a497ae4dad645673592c2e4ef9c01473f005e3b521e874ee26c52950f35462b2d4bd53d8
SSDEEP

49152:RimYBm+/sYQHJclWXFFRncIXy57MBiyPz8:RJkmk5WcIXyZMBiyPA

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Files

File.bin
.exe windows x86

Code Sign

1b:56:f3:15:10:c1:bd:92:42:ce:a2:b0:83:e9:9a:c3
Certificate

Issuer

CN=HP 200 G4 9UG57EA Europe

Not Before

19/06/2022, 14:17

Not After

20/06/2032, 14:17

Subject

CN=HP 200 G4 9UG57EA Europe

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8d:83:31:96:19:d8:e8:f9:2c:72:d0:c0:ee:a0:e8:da:70:1d:e7:ff:da:c6:88:83:76:4e:62:65:a3:86:c8:ae
Signer

Actual PE Digest

8d:83:31:96:19:d8:e8:f9:2c:72:d0:c0:ee:a0:e8:da:70:1d:e7:ff:da:c6:88:83:76:4e:62:65:a3:86:c8:ae

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=HP 200 G4 9UG57EA Europe

23/06/2022, 17:36
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

Size: 172KB - Virtual size: 391KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 2KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 13KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 1024B - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 52B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 14KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 312KB - Virtual size: 312KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.themida
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 16B - Virtual size: 4KB

IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

1b:56:f3:15:10:c1:bd:92:42:ce:a2:b0:83:e9:9a:c3Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

8d:83:31:96:19:d8:e8:f9:2c:72:d0:c0:ee:a0:e8:da:70:1d:e7:ff:da:c6:88:83:76:4e:62:65:a3:86:c8:aeSigner

Signature Validations

Verification

23/06/2022, 17:36 Valid: false

Headers

DLL Characteristics

File Characteristics

Sections

Size: 172KB - Virtual size: 391KB

Size: 3KB - Virtual size: 8KB

Size: 2KB - Virtual size: 7KB

.bss Size: - Virtual size: 13KB

Size: 1024B - Virtual size: 9KB

.tls Size: - Virtual size: 52B

Size: 512B - Virtual size: 24B

Size: 14KB - Virtual size: 28KB

.rsrc Size: 312KB - Virtual size: 312KB

.idata Size: 512B - Virtual size: 4KB

.tls Size: 512B - Virtual size: 4KB

.themida Size: 3.1MB - Virtual size: 3.1MB

.reloc Size: 16B - Virtual size: 4KB

1b:56:f3:15:10:c1:bd:92:42:ce:a2:b0:83:e9:9a:c3
Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

8d:83:31:96:19:d8:e8:f9:2c:72:d0:c0:ee:a0:e8:da:70:1d:e7:ff:da:c6:88:83:76:4e:62:65:a3:86:c8:ae
Signer

23/06/2022, 17:36
Valid: false

.bss
Size: - Virtual size: 13KB

.tls
Size: - Virtual size: 52B

.rsrc
Size: 312KB - Virtual size: 312KB

.idata
Size: 512B - Virtual size: 4KB

.tls
Size: 512B - Virtual size: 4KB

.themida
Size: 3.1MB - Virtual size: 3.1MB

.reloc
Size: 16B - Virtual size: 4KB