9b06361b484531e8d71b64fbb32534d9[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

9b06361b484531e8d71b64fbb32534d9.exe
Size

2.3MB
MD5

9b06361b484531e8d71b64fbb32534d9
SHA1

6c47e8bfaf1b82c57c861312f1fe130cc5e21c96
SHA256

753fbc1dfa05d6007c5dfa534a7d019cbb24d07224b67ae9d48c9772039c63cd
SHA512

dd9ab0d96801bdc8e541c60f0cb23f8c5089f8cefd4fa9041dae5d6d7e393f27ff25cc445117e3804f235fabce0fd2ae80d284463ef2278da5afb6a81f285bbb
SSDEEP

49152:SgUFBrKkyuD7ug6e1NsUfgvig28JUU1y4unHZ1IxLRoV:eJK1umgBUU+n28uUMxHXIh6

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Files

9b06361b484531e8d71b64fbb32534d9.exe
.exe windows x86

Code Sign

41:c8:b2:03:d6:ee:1e:b3:47:e5:ac:c5:1b:49:ea:d0
Certificate

Issuer

CN=True Wireless Philips TAT2206BK/00 Black

Not Before

14-07-2023 10:26

Not After

15-07-2033 10:26

Subject

CN=True Wireless Philips TAT2206BK/00 Black

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03-05-2023 00:00

Not After

02-08-2034 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

df:b1:4f:eb:39:9a:0b:88:4a:71:8d:ac:d9:c6:64:ba:65:28:40:42:0d:95:68:17:23:86:eb:24:2c:a9:ce:5f
Signer

Actual PE Digest

df:b1:4f:eb:39:9a:0b:88:4a:71:8d:ac:d9:c6:64:ba:65:28:40:42:0d:95:68:17:23:86:eb:24:2c:a9:ce:5f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 331KB - Virtual size: 392KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 123KB - Virtual size: 123KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.themida
Size: - Virtual size: 3.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

41:c8:b2:03:d6:ee:1e:b3:47:e5:ac:c5:1b:49:ea:d0Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

df:b1:4f:eb:39:9a:0b:88:4a:71:8d:ac:d9:c6:64:ba:65:28:40:42:0d:95:68:17:23:86:eb:24:2c:a9:ce:5fSigner

Headers

DLL Characteristics

File Characteristics

Sections

Size: 331KB - Virtual size: 392KB

.rsrc Size: 123KB - Virtual size: 123KB

Size: 512B - Virtual size: 12B

.idata Size: 512B - Virtual size: 8KB

.themida Size: - Virtual size: 3.3MB

.boot Size: 1.9MB - Virtual size: 1.9MB

41:c8:b2:03:d6:ee:1e:b3:47:e5:ac:c5:1b:49:ea:d0
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

df:b1:4f:eb:39:9a:0b:88:4a:71:8d:ac:d9:c6:64:ba:65:28:40:42:0d:95:68:17:23:86:eb:24:2c:a9:ce:5f
Signer

.rsrc
Size: 123KB - Virtual size: 123KB

.idata
Size: 512B - Virtual size: 8KB

.themida
Size: - Virtual size: 3.3MB

.boot
Size: 1.9MB - Virtual size: 1.9MB