Setup[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Setup.exe
Size

412.9MB
MD5

8d93526ad78ed499839a5a895a8b910a
SHA1

f8ab0108f94cd570e8ae7c57ca0fc23a0d02b83f
SHA256

75e5c5362edd24589a23da20b3f9423a01475740b2fc045c954215ac802d8a6f
SHA512

e7c3b0278e9cab9a9470b76a10ad6fee59874611a143076bb318f7aa6afb667d9f03564a6c3b32e6fba4ec2bab84627163d2626cf35fb954cc36404f3c3f2e58
SSDEEP

196608:zy5JeX2MlVHlRk4HFFYz2Eywbv6p64Ct0Hiz+Cw:zydMpRlFlEyw284Ct0CzH

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Files

Setup.exe
.exe windows x86

Code Sign

19:78:25:74:4e:53:63:8a:42:b3:bb:bf:21:5f:98:c0
Certificate

Issuer

CN=A҉N҉G҉E҉LA҉N҉G҉E҉LA҉N҉G҉E҉LA҉N҉G҉E҉LA҉N҉G҉E҉LA҉N҉G҉E҉LA҉N҉G҉E҉L

Not Before

15/09/2022, 12:43

Not After

16/09/2032, 12:43

Subject

CN=A҉N҉G҉E҉LA҉N҉G҉E҉LA҉N҉G҉E҉LA҉N҉G҉E҉LA҉N҉G҉E҉LA҉N҉G҉E҉LA҉N҉G҉E҉L

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a9:73:90:d0:53:09:fc:29:09:96:32:59:0b:52:33:12:16:d3:a9:23:14:7e:f9:a0:f3:fb:d4:0d:66:34:ad:8c
Signer

Actual PE Digest

a9:73:90:d0:53:09:fc:29:09:96:32:59:0b:52:33:12:16:d3:a9:23:14:7e:f9:a0:f3:fb:d4:0d:66:34:ad:8c

Digest Algorithm

sha256

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=A҉N҉G҉E҉LA҉N҉G҉E҉LA҉N҉G҉E҉LA҉N҉G҉E҉LA҉N҉G҉E҉LA҉N҉G҉E҉LA҉N҉G҉E҉L

15/09/2022, 14:52
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 20KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 242KB - Virtual size: 242KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.themida
Size: 5.3MB - Virtual size: 5.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Code Sign

19:78:25:74:4e:53:63:8a:42:b3:bb:bf:21:5f:98:c0Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

a9:73:90:d0:53:09:fc:29:09:96:32:59:0b:52:33:12:16:d3:a9:23:14:7e:f9:a0:f3:fb:d4:0d:66:34:ad:8cSigner

Signature Validations

Verification

15/09/2022, 14:52 Valid: false

Headers

DLL Characteristics

File Characteristics

Sections

Size: 20KB - Virtual size: 44KB

Size: 5KB - Virtual size: 8KB

.data Size: - Virtual size: 1KB

Size: 512B - Virtual size: 4B

Size: 5KB - Virtual size: 5KB

.rsrc Size: 242KB - Virtual size: 242KB

.idata Size: 512B - Virtual size: 4KB

.themida Size: 5.3MB - Virtual size: 5.3MB

19:78:25:74:4e:53:63:8a:42:b3:bb:bf:21:5f:98:c0
Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

a9:73:90:d0:53:09:fc:29:09:96:32:59:0b:52:33:12:16:d3:a9:23:14:7e:f9:a0:f3:fb:d4:0d:66:34:ad:8c
Signer

15/09/2022, 14:52
Valid: false

.data
Size: - Virtual size: 1KB

.rsrc
Size: 242KB - Virtual size: 242KB

.idata
Size: 512B - Virtual size: 4KB

.themida
Size: 5.3MB - Virtual size: 5.3MB