Setup[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

Setup.exe
Size

374.9MB
MD5

f5c0fb1212d5f364f007839ab4e00502
SHA1

289c9cd7552a8964e238f29a0521e3f316d64421
SHA256

db0a923f4a045fb8b61913b0cd366f8f1c777091699090baaf8d545c79e93af3
SHA512

14f7e8e9ea9641812329f95f4253617228f72afde2af4038b4e16bdad7feba0b065e94909645df08994e90d1bf61ee0e1a599ad7d1f3f768a3b3ff76082854da
SSDEEP

98304:M5swvJ74S+Z2GSux2gOZK9H9Cup6h1fxPZpPpePqQsxJP1f:M5swh7L+gPux2gOs9oup+1pzpeCx

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Files

Setup.exe
.exe windows x86

Code Sign

12:b9:40:c0:40:22:90:ba:47:95:63:88:96:e9:c4:37
Certificate

Issuer

CN=HDD Toshiba SATA-III 10Tb HDWG460EZSTA N300 (7200rpm) 2048Mb 2.5 Rtl

Not Before

15/10/2022, 10:21

Not After

16/10/2032, 10:21

Subject

CN=HDD Toshiba SATA-III 10Tb HDWG460EZSTA N300 (7200rpm) 2048Mb 2.5 Rtl

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:fc:9a:33:08:28:7a:74:93:a2:d8:0c:86:38:c6:0b:73:76:be:d9:77:9b:b4:fe:c1:85:11:79:d1:12:96:26
Signer

Actual PE Digest

06:fc:9a:33:08:28:7a:74:93:a2:d8:0c:86:38:c6:0b:73:76:be:d9:77:9b:b4:fe:c1:85:11:79:d1:12:96:26

Digest Algorithm

sha256

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=HDD Toshiba SATA-III 10Tb HDWG460EZSTA N300 (7200rpm) 2048Mb 2.5 Rtl

02/11/2022, 14:03
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 1024B - Virtual size: 989B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 678B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 90KB - Virtual size: 167KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 251KB - Virtual size: 435KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 5.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 3.8MB - Virtual size: 3.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

12:b9:40:c0:40:22:90:ba:47:95:63:88:96:e9:c4:37Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

06:fc:9a:33:08:28:7a:74:93:a2:d8:0c:86:38:c6:0b:73:76:be:d9:77:9b:b4:fe:c1:85:11:79:d1:12:96:26Signer

Signature Validations

Verification

02/11/2022, 14:03 Valid: false

Headers

DLL Characteristics

File Characteristics

Sections

Size: 1024B - Virtual size: 989B

Size: 512B - Virtual size: 678B

Size: 90KB - Virtual size: 167KB

Size: 251KB - Virtual size: 435KB

Size: 512B - Virtual size: 72B

.idata Size: 512B - Virtual size: 4KB

.rsrc Size: 35KB - Virtual size: 35KB

.themida Size: - Virtual size: 5.9MB

.boot Size: 3.8MB - Virtual size: 3.8MB

12:b9:40:c0:40:22:90:ba:47:95:63:88:96:e9:c4:37
Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

06:fc:9a:33:08:28:7a:74:93:a2:d8:0c:86:38:c6:0b:73:76:be:d9:77:9b:b4:fe:c1:85:11:79:d1:12:96:26
Signer

02/11/2022, 14:03
Valid: false

.idata
Size: 512B - Virtual size: 4KB

.rsrc
Size: 35KB - Virtual size: 35KB

.themida
Size: - Virtual size: 5.9MB

.boot
Size: 3.8MB - Virtual size: 3.8MB