19b0486caa9d36d7a358a25fffc5c549e95ad922ec7068667744ffcd206b2539

Sharing

Copy URL

Twitter E-mail

General

Target

19b0486caa9d36d7a358a25fffc5c549e95ad922ec7068667744ffcd206b2539
Size

3.2MB
MD5

00f73ae5d08c848ed4df5ca8e4a40133
SHA1

7c9fe77827aefc421887a02450133becc1049ef5
SHA256

19b0486caa9d36d7a358a25fffc5c549e95ad922ec7068667744ffcd206b2539
SHA512

2c5118a8648b94e551b2e9d63621f495b7dfac93bf2d5088c4813a7d73d5376c07c74cb350d1b99bfa41ea2c1ac8e3f7188569418aca6f03d8b7ea7c66b236be
SSDEEP

49152:V8Dtl2xb/mj7iJktYmEpJc2fI8reP3jW0WtcXgACW6oLm6RiUeus+/Mnys3bHQb:VYtoxbOX5YmEsf8qPiPM6+RRiUX/UFQb

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
sample	themida

Files

19b0486caa9d36d7a358a25fffc5c549e95ad922ec7068667744ffcd206b2539
.exe windows x86

Code Sign

0e:9a:86:d7:74:54:a2:f7:c5:59:09:cb:f5:f8:5d:d3
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04-11-2020 00:00

Not After

02-01-2024 23:59

Subject

CN=Doctor Web Ltd.,O=Doctor Web Ltd.,L=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2013 12:00

Not After

22-10-2028 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8b:6a:5c:de:fe:ef:fc:3b:e1:fb:7a:39:f0:b6:bb:04:cd:b3:7d:26:65:a1:41:ab:c1:4a:49:d1:d0:d0:8c:00
Signer

Actual PE Digest

8b:6a:5c:de:fe:ef:fc:3b:e1:fb:7a:39:f0:b6:bb:04:cd:b3:7d:26:65:a1:41:ab:c1:4a:49:d1:d0:d0:8c:00

Digest Algorithm

sha256

PE Digest Matches

false

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Doctor Web Ltd.,O=Doctor Web Ltd.,L=Moscow,C=RU

30-06-2022 15:40
Valid: true

Chain 1

CN=Doctor Web Ltd.,O=Doctor Web Ltd.,L=Moscow,C=RU

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Sections

Size: 114KB - Virtual size: 212KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 39B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 9KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 9KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: - Virtual size: 1KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 323B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 31B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 6B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 31KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.imports
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 4.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

0e:9a:86:d7:74:54:a2:f7:c5:59:09:cb:f5:f8:5d:d3Certificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

8b:6a:5c:de:fe:ef:fc:3b:e1:fb:7a:39:f0:b6:bb:04:cd:b3:7d:26:65:a1:41:ab:c1:4a:49:d1:d0:d0:8c:00Signer

Signature Validations

Verification

30-06-2022 15:40 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Sections

Size: 114KB - Virtual size: 212KB

Size: 39B - Virtual size: 56B

Size: 9KB - Virtual size: 11KB

Size: 9KB - Virtual size: 35KB

Size: - Virtual size: 1KB

Size: 323B - Virtual size: 3KB

Size: 31B - Virtual size: 56B

Size: 6B - Virtual size: 8B

Size: 31KB - Virtual size: 51KB

.imports Size: 512B - Virtual size: 4KB

.tls Size: 512B - Virtual size: 4KB

.rsrc Size: 13KB - Virtual size: 13KB

.themida Size: - Virtual size: 4.3MB

.boot Size: 3.0MB - Virtual size: 3.0MB

0e:9a:86:d7:74:54:a2:f7:c5:59:09:cb:f5:f8:5d:d3
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

8b:6a:5c:de:fe:ef:fc:3b:e1:fb:7a:39:f0:b6:bb:04:cd:b3:7d:26:65:a1:41:ab:c1:4a:49:d1:d0:d0:8c:00
Signer

30-06-2022 15:40
Valid: true

.imports
Size: 512B - Virtual size: 4KB

.tls
Size: 512B - Virtual size: 4KB

.rsrc
Size: 13KB - Virtual size: 13KB

.themida
Size: - Virtual size: 4.3MB

.boot
Size: 3.0MB - Virtual size: 3.0MB