00FC3CD6E8696CF8EEA722198A6B7469[.]fil

Sharing

Copy URL

Twitter E-mail

General

Target

00FC3CD6E8696CF8EEA722198A6B7469.fil
Size

5.5MB
MD5

00fc3cd6e8696cf8eea722198a6b7469
SHA1

0f1b48ef3dab7a257ded76e016eb02ab6100218a
SHA256

2142d70eae48bea2173d8a1d161daa71546ae8a27e2719f0f013b723ffe7a0ec
SHA512

80f998440901e10637618056c9ce153682185ee1f66196a914c6ea9f870add90305547cd611cace3d0e74696bae7e8c9ea283780682286a3c392c4e259d0dec0
SSDEEP

98304:m8DoM/wRdRUiUy4G6tsz45cr0E5DSy3i8OF2fMfAHUD4MB+q8Rp0pUm1ZsdHeBU0:VoMoDU3yJ6tsE5sFDSv8OFOHUD4MgTRg

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs
Detects Themida, an advanced Windows software protection system.
themida

Processes:

resource yara_rule

sample themida

resource	yara_rule
sample	themida

Files

00FC3CD6E8696CF8EEA722198A6B7469.fil
.exe windows x86

86dcef20810f0da439c722b470fe2ebf

Code Sign

67:4a:eb:f7:49:70:54:a3:43:4a:60:70:e1:58:2d:40
Certificate

Issuer

CN=JBL Słuchawki nauszne JBL Cloud` 60~9 Combo

Not Before

27-07-2022 11:48

Not After

28-07-2032 11:48

Subject

CN=JBL Słuchawki nauszne JBL Cloud` 60~9 Combo

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11-05-2022 00:00

Not After

10-08-2033 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ac:d9:f7:b8:42:03:26:0b:11:87:06:f0:f9:fe:ec:6d:c0:ff:12:81:52:15:39:40:58:06:c6:e5:d5:5d:84:b9
Signer

Actual PE Digest

ac:d9:f7:b8:42:03:26:0b:11:87:06:f0:f9:fe:ec:6d:c0:ff:12:81:52:15:39:40:58:06:c6:e5:d5:5d:84:b9

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=JBL Słuchawki nauszne JBL Cloud` 60~9 Combo

28-07-2022 15:39
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

CharUpperBuffW

Sections

Size: - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

ש�
Size: - Virtual size: 487KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vm_sec
Size: - Virtual size: 160KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.themida
Size: - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ש�
Size: - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

ש�
Size: 1024B - Virtual size: 848B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ש�
Size: 5.4MB - Virtual size: 5.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

86dcef20810f0da439c722b470fe2ebf

Code Sign

67:4a:eb:f7:49:70:54:a3:43:4a:60:70:e1:58:2d:40Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

ac:d9:f7:b8:42:03:26:0b:11:87:06:f0:f9:fe:ec:6d:c0:ff:12:81:52:15:39:40:58:06:c6:e5:d5:5d:84:b9Signer

Signature Validations

Verification

28-07-2022 15:39 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

Sections

Size: - Virtual size: 39KB

Size: - Virtual size: 5KB

.data Size: - Virtual size: 3KB

Size: - Virtual size: 4B

Size: - Virtual size: 5KB

ש� Size: - Virtual size: 487KB

.vm_sec Size: - Virtual size: 160KB

.idata Size: - Virtual size: 4KB

.themida Size: - Virtual size: 2.1MB

ש� Size: - Virtual size: 2.5MB

ש� Size: 1024B - Virtual size: 848B

ש� Size: 5.4MB - Virtual size: 5.4MB

.reloc Size: 1KB - Virtual size: 1KB

.rsrc Size: 47KB - Virtual size: 47KB

67:4a:eb:f7:49:70:54:a3:43:4a:60:70:e1:58:2d:40
Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

ac:d9:f7:b8:42:03:26:0b:11:87:06:f0:f9:fe:ec:6d:c0:ff:12:81:52:15:39:40:58:06:c6:e5:d5:5d:84:b9
Signer

28-07-2022 15:39
Valid: false

.data
Size: - Virtual size: 3KB

ש�
Size: - Virtual size: 487KB

.vm_sec
Size: - Virtual size: 160KB

.idata
Size: - Virtual size: 4KB

.themida
Size: - Virtual size: 2.1MB

ש�
Size: - Virtual size: 2.5MB

ש�
Size: 1024B - Virtual size: 848B

ש�
Size: 5.4MB - Virtual size: 5.4MB

.reloc
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 47KB - Virtual size: 47KB