a543adcbb3b3edc471dc15e77c1b568410026e077ea53145adaf98bdaea411f2

Sharing

Copy URL Twitter E-mail

General

Target

a543adcbb3b3edc471dc15e77c1b568410026e077ea53145adaf98bdaea411f2
Size

5.0MB
MD5

ca3df403430c5375f6308d8daf3f4652
SHA1

1f7bcb6bccd85f95f51ebfc9091dc47b35f6440c
SHA256

a543adcbb3b3edc471dc15e77c1b568410026e077ea53145adaf98bdaea411f2
SHA512

2a0e8aa6495404360f91b3fa78d87f8da3af4402813cbbb038591cf878076fe7d50f4e4aa9f307f558a3920ccfb2d6d03626d46b0544e9bb63f95cf01038782b
SSDEEP

98304:PeeDTN7a2FS6xqUZnD6OANtQcO5ITzV8EO3msoYG4:bvN7a/sqUJDHAnR5J8EO3ma

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Files

a543adcbb3b3edc471dc15e77c1b568410026e077ea53145adaf98bdaea411f2
.exe windows x86

Code Sign

17:20:e4:dc:89:71:13:cd
Certificate

Issuer

CN=Adler SignKey CA,O=Adler Soft Development,L=Luhansk

Not Before

10/04/2023, 00:00

Not After

10/04/2024, 00:00

Subject

CN=BlueworldCompany,[email protected],[email protected],C=BR,1.2.840.113549.1.9.1=#0c1b426c7565776f726c64436f6d70616e79406d61696c746f2e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

17:20:e4:dc:89:71:13:cd
Certificate

Issuer

CN=Adler SignKey CA,O=Adler Soft Development,L=Luhansk

Not Before

10/04/2023, 00:00

Not After

10/04/2024, 00:00

Subject

CN=BlueworldCompany,[email protected],[email protected],C=BR,1.2.840.113549.1.9.1=#0c1b426c7565776f726c64436f6d70616e79406d61696c746f2e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

64:80:ca:4a:6a:9c:be:33:70:80:77:1d:2f:1f:b5:cd:3f:d1:96:91:f2:1c:3a:24:55:ca:0e:e8:fe:9f:3f:51
Signer

Actual PE Digest

64:80:ca:4a:6a:9c:be:33:70:80:77:1d:2f:1f:b5:cd:3f:d1:96:91:f2:1c:3a:24:55:ca:0e:e8:fe:9f:3f:51

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=BlueworldCompany,[email protected],[email protected],C=BR,1.2.840.113549.1.9.1=#0c1b426c7565776f726c64436f6d70616e79406d61696c746f2e636f6d

06/04/2023, 09:36
Valid: false

7a:c4:98:78:48:59:0c:12:87:01:c8:6e:5b:cb:bf:a5:71:d6:1a:51
Signer

Actual PE Digest

7a:c4:98:78:48:59:0c:12:87:01:c8:6e:5b:cb:bf:a5:71:d6:1a:51

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=BlueworldCompany,[email protected],[email protected],C=BR,1.2.840.113549.1.9.1=#0c1b426c7565776f726c64436f6d70616e79406d61696c746f2e636f6d

06/04/2023, 09:36
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 30KB - Virtual size: 51KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 92KB - Virtual size: 117KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 1KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.themida
Size: 4.9MB - Virtual size: 4.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Code Sign

17:20:e4:dc:89:71:13:cdCertificate

Extended Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate

Extended Key Usages

Key Usages

17:20:e4:dc:89:71:13:cdCertificate

Extended Key Usages

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

64:80:ca:4a:6a:9c:be:33:70:80:77:1d:2f:1f:b5:cd:3f:d1:96:91:f2:1c:3a:24:55:ca:0e:e8:fe:9f:3f:51Signer

Signature Validations

Verification

06/04/2023, 09:36 Valid: false

7a:c4:98:78:48:59:0c:12:87:01:c8:6e:5b:cb:bf:a5:71:d6:1a:51Signer

Signature Validations

Verification

06/04/2023, 09:36 Valid: false

Headers

DLL Characteristics

File Characteristics

Sections

Size: 30KB - Virtual size: 51KB

Size: 92KB - Virtual size: 117KB

Size: 1KB - Virtual size: 13KB

Size: 2KB - Virtual size: 4KB

.idata Size: 512B - Virtual size: 4KB

.themida Size: 4.9MB - Virtual size: 4.9MB

17:20:e4:dc:89:71:13:cd
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

17:20:e4:dc:89:71:13:cd
Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

64:80:ca:4a:6a:9c:be:33:70:80:77:1d:2f:1f:b5:cd:3f:d1:96:91:f2:1c:3a:24:55:ca:0e:e8:fe:9f:3f:51
Signer

06/04/2023, 09:36
Valid: false

7a:c4:98:78:48:59:0c:12:87:01:c8:6e:5b:cb:bf:a5:71:d6:1a:51
Signer

06/04/2023, 09:36
Valid: false

.idata
Size: 512B - Virtual size: 4KB

.themida
Size: 4.9MB - Virtual size: 4.9MB