file[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

file.exe
Size

2.5MB
MD5

5a2c4084ebdeb76455b60e0ed558849a
SHA1

fef093e32adfd1a58e0559289a0e1ea58b930e2c
SHA256

083842534185758ad03c0a124d2a0a629225d97f3e3c4776c1ff727adeaae4c6
SHA512

047e7205cee7eb28828341530b0cd00d7dcc54806b1e9197f6c611d1e0f9dbc06b24dba163c87145bdb399ba987c3e391f671a0ceb4e4fbc8735a53f61a801fd
SSDEEP

49152:3NePgTE1KWZAfLuaCe4q29CWFE7RSV6CVaai9wJNxL0Xbn:939LuahA5EsEnai9J7

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Files

file.exe
.exe windows x64

Code Sign

46:92:f3:69:0e:d7:50:b7:49:d7:f8:8b:15:ec:25:19
Certificate

Issuer

CN=Canon PowerShot SX620 HS

Not Before

07/12/2022, 13:04

Not After

08/12/2032, 13:04

Subject

CN=Canon PowerShot SX620 HS

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

76:d5:f6:db:60:95:6f:54:5a:cb:94:6c:4e:2b:00:5b:a2:09:65:85:57:c1:0b:66:64:ff:e4:26:af:d9:01:bb
Signer

Actual PE Digest

76:d5:f6:db:60:95:6f:54:5a:cb:94:6c:4e:2b:00:5b:a2:09:65:85:57:c1:0b:66:64:ff:e4:26:af:d9:01:bb

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Canon PowerShot SX620 HS

15/12/2022, 13:55
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Size: 665KB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 97KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.themida
Size: - Virtual size: 4.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

46:92:f3:69:0e:d7:50:b7:49:d7:f8:8b:15:ec:25:19Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

76:d5:f6:db:60:95:6f:54:5a:cb:94:6c:4e:2b:00:5b:a2:09:65:85:57:c1:0b:66:64:ff:e4:26:af:d9:01:bbSigner

Signature Validations

Verification

15/12/2022, 13:55 Valid: false

Headers

DLL Characteristics

File Characteristics

Sections

Size: 665KB - Virtual size: 1.7MB

.rsrc Size: 97KB - Virtual size: 96KB

.idata Size: 512B - Virtual size: 8KB

.themida Size: - Virtual size: 4.1MB

.boot Size: 1.8MB - Virtual size: 1.8MB

46:92:f3:69:0e:d7:50:b7:49:d7:f8:8b:15:ec:25:19
Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

76:d5:f6:db:60:95:6f:54:5a:cb:94:6c:4e:2b:00:5b:a2:09:65:85:57:c1:0b:66:64:ff:e4:26:af:d9:01:bb
Signer

15/12/2022, 13:55
Valid: false

.rsrc
Size: 97KB - Virtual size: 96KB

.idata
Size: 512B - Virtual size: 8KB

.themida
Size: - Virtual size: 4.1MB

.boot
Size: 1.8MB - Virtual size: 1.8MB