tmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

tmp
Size

4.8MB
MD5

5d5d985bba72a4c9237a8fc151531f85
SHA1

576ae839026156a682ab488339e6754819ad5e64
SHA256

bc45ddc6da1d094442c0962a1c37522fe719aff822097960f6f68b8b9bad0322
SHA512

fa61dd3b2c3e76c4ac7564c09d0e34be75a2157f2cf792f942a49d6ff4da0ea302dc63d1bc571a1819fecd8e3eeba79cecad018b0fe3b2661c495b76f0366a57
SSDEEP

98304:hx8Ab8mzc8cZlcGigfEO7+sB31RayZjcRy79:JNd3ova6cRQ

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Files

tmp
.exe windows x86

Code Sign

67:97:91:f6:68:16:b8:ae:4a:8e:5e:34:76:ba:bb:f0
Certificate

Issuer

CN=₩ ₪ ₫ ₭ ₯ ₰ ₱ ₲ ₳ ₴ ₵ ￥ ﷼ ¤ ƒ₩ ₪ ₫ ₭ ₯ ₰ ₱ ₲ ₳ ₴ ₵ ￥ ﷼ ¤ ƒ

Not Before

21/09/2022, 19:56

Not After

22/09/2032, 19:56

Subject

CN=₩ ₪ ₫ ₭ ₯ ₰ ₱ ₲ ₳ ₴ ₵ ￥ ﷼ ¤ ƒ₩ ₪ ₫ ₭ ₯ ₰ ₱ ₲ ₳ ₴ ₵ ￥ ﷼ ¤ ƒ

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f1:1e:a6:58:3c:36:98:8d:01:34:2e:5c:1b:ca:eb:40:d9:14:a0:30:41:f5:3a:28:60:2b:51:0c:b6:38:3e:2a
Signer

Actual PE Digest

f1:1e:a6:58:3c:36:98:8d:01:34:2e:5c:1b:ca:eb:40:d9:14:a0:30:41:f5:3a:28:60:2b:51:0c:b6:38:3e:2a

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=₩ ₪ ₫ ₭ ₯ ₰ ₱ ₲ ₳ ₴ ₵ ￥ ﷼ ¤ ƒ₩ ₪ ₫ ₭ ₯ ₰ ₱ ₲ ₳ ₴ ₵ ￥ ﷼ ¤ ƒ

23/09/2022, 10:46
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 18KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 392KB - Virtual size: 568KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Size: 71KB - Virtual size: 465KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: 4.3MB - Virtual size: 4.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Code Sign

67:97:91:f6:68:16:b8:ae:4a:8e:5e:34:76:ba:bb:f0Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

f1:1e:a6:58:3c:36:98:8d:01:34:2e:5c:1b:ca:eb:40:d9:14:a0:30:41:f5:3a:28:60:2b:51:0c:b6:38:3e:2aSigner

Signature Validations

Verification

23/09/2022, 10:46 Valid: false

Headers

DLL Characteristics

File Characteristics

Sections

Size: 18KB - Virtual size: 44KB

Size: 5KB - Virtual size: 8KB

.data Size: - Virtual size: 1KB

Size: 512B - Virtual size: 4B

Size: 392KB - Virtual size: 568KB

Size: 4KB - Virtual size: 6KB

Size: 71KB - Virtual size: 465KB

.idata Size: 512B - Virtual size: 4KB

.rsrc Size: 4KB - Virtual size: 4KB

.themida Size: 4.3MB - Virtual size: 4.3MB

67:97:91:f6:68:16:b8:ae:4a:8e:5e:34:76:ba:bb:f0
Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

f1:1e:a6:58:3c:36:98:8d:01:34:2e:5c:1b:ca:eb:40:d9:14:a0:30:41:f5:3a:28:60:2b:51:0c:b6:38:3e:2a
Signer

23/09/2022, 10:46
Valid: false

.data
Size: - Virtual size: 1KB

.idata
Size: 512B - Virtual size: 4KB

.rsrc
Size: 4KB - Virtual size: 4KB

.themida
Size: 4.3MB - Virtual size: 4.3MB