80c6295061e4ec838c962fef5d405c9c6df784cdba3f484a868792695501f438

Sharing

Copy URL Twitter E-mail

General

Target

80c6295061e4ec838c962fef5d405c9c6df784cdba3f484a868792695501f438
Size

2.0MB
MD5

b446cc03d61a54d5995743169a9d18eb
SHA1

03fe914e2b050f9111c8448d2b301555187e0f0c
SHA256

80c6295061e4ec838c962fef5d405c9c6df784cdba3f484a868792695501f438
SHA512

cf8a68f1f4e88b4f29267a32ea0e8fa0eecf319cdf7eecd5e4820bc59586c16de428de38cbf05527270a1b059d90e01930ee753787b13924c11247828f0c42f8
SSDEEP

49152:wv26s6R+qlNn+jvD6XKiI23zwwn4n0AP/lUY8gHUs6a5aV+i:W2wDZXK8D5nQNUY8gmVV+i

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Files

80c6295061e4ec838c962fef5d405c9c6df784cdba3f484a868792695501f438
.exe windows x64

Code Sign

30:a9:8f:5d:a1:10:41:a1
Certificate

Issuer

CN=Adler SignKey CA,O=Adler Soft Development,L=Luhansk

Not Before

09/04/2023, 00:00

Not After

09/04/2028, 00:00

Subject

CN=OnlineSoftware,O=OnlineSoftware,L=Raccoun,C=US,1.2.840.113549.1.9.1=#0c1a4f6e6c696e65536f66747761726540636f6d70616e792e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:a9:8f:5d:a1:10:41:a1
Certificate

Issuer

CN=Adler SignKey CA,O=Adler Soft Development,L=Luhansk

Not Before

09/04/2023, 00:00

Not After

09/04/2028, 00:00

Subject

CN=OnlineSoftware,O=OnlineSoftware,L=Raccoun,C=US,1.2.840.113549.1.9.1=#0c1a4f6e6c696e65536f66747761726540636f6d70616e792e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

eb:5a:3a:29:73:96:f6:60:18:28:4e:2c:80:95:f6:e3:dd:86:7a:a3:7e:37:bc:a3:1b:27:79:96:ae:fb:90:d2
Signer

Actual PE Digest

eb:5a:3a:29:73:96:f6:60:18:28:4e:2c:80:95:f6:e3:dd:86:7a:a3:7e:37:bc:a3:1b:27:79:96:ae:fb:90:d2

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=OnlineSoftware,O=OnlineSoftware,L=Raccoun,C=US,1.2.840.113549.1.9.1=#0c1a4f6e6c696e65536f66747761726540636f6d70616e792e636f6d

03/05/2023, 12:01
Valid: false

4a:d4:0b:4b:aa:54:83:f8:8e:10:47:61:6c:60:a7:be:88:9a:a8:c0
Signer

Actual PE Digest

4a:d4:0b:4b:aa:54:83:f8:8e:10:47:61:6c:60:a7:be:88:9a:a8:c0

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=OnlineSoftware,O=OnlineSoftware,L=Raccoun,C=US,1.2.840.113549.1.9.1=#0c1a4f6e6c696e65536f66747761726540636f6d70616e792e636f6d

03/05/2023, 12:01
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.text
Size: 150KB - Virtual size: 149KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 70KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.themida
Size: - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

30:a9:8f:5d:a1:10:41:a1Certificate

Extended Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate

Extended Key Usages

Key Usages

30:a9:8f:5d:a1:10:41:a1Certificate

Extended Key Usages

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

eb:5a:3a:29:73:96:f6:60:18:28:4e:2c:80:95:f6:e3:dd:86:7a:a3:7e:37:bc:a3:1b:27:79:96:ae:fb:90:d2Signer

Signature Validations

Verification

03/05/2023, 12:01 Valid: false

4a:d4:0b:4b:aa:54:83:f8:8e:10:47:61:6c:60:a7:be:88:9a:a8:c0Signer

Signature Validations

Verification

03/05/2023, 12:01 Valid: false

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 150KB - Virtual size: 149KB

.rdata Size: 70KB - Virtual size: 69KB

.data Size: 4KB - Virtual size: 10KB

.pdata Size: 11KB - Virtual size: 10KB

_RDATA Size: 512B - Virtual size: 244B

.reloc Size: 2KB - Virtual size: 2KB

.idata Size: 512B - Virtual size: 4KB

.themida Size: - Virtual size: 3.1MB

.boot Size: 1.7MB - Virtual size: 1.7MB

30:a9:8f:5d:a1:10:41:a1
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

30:a9:8f:5d:a1:10:41:a1
Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

eb:5a:3a:29:73:96:f6:60:18:28:4e:2c:80:95:f6:e3:dd:86:7a:a3:7e:37:bc:a3:1b:27:79:96:ae:fb:90:d2
Signer

03/05/2023, 12:01
Valid: false

4a:d4:0b:4b:aa:54:83:f8:8e:10:47:61:6c:60:a7:be:88:9a:a8:c0
Signer

03/05/2023, 12:01
Valid: false

.text
Size: 150KB - Virtual size: 149KB

.rdata
Size: 70KB - Virtual size: 69KB

.data
Size: 4KB - Virtual size: 10KB

.pdata
Size: 11KB - Virtual size: 10KB

_RDATA
Size: 512B - Virtual size: 244B

.reloc
Size: 2KB - Virtual size: 2KB

.idata
Size: 512B - Virtual size: 4KB

.themida
Size: - Virtual size: 3.1MB

.boot
Size: 1.7MB - Virtual size: 1.7MB