b2ce15fdc2b519d9a71fdc576dddd336a1b3a25335bc4ded9c8ec9120e92bbf1

Sharing

Copy URL

Twitter E-mail

General

Target

b2ce15fdc2b519d9a71fdc576dddd336a1b3a25335bc4ded9c8ec9120e92bbf1
Size

2.8MB
MD5

4fee4dfe32401be36ab9d2f6e41f6228
SHA1

897fe7fb7242cc6ec4964183141a8f0c7d5f172e
SHA256

b2ce15fdc2b519d9a71fdc576dddd336a1b3a25335bc4ded9c8ec9120e92bbf1
SHA512

cb2f786ab00d7e1484cc977f56daf7e555909fdc7a9da14e0f541ef00b58fb8f78241c4cb79dccbe7d99cb7e772c3791d143346c1e75604e98176c121cb55c18
SSDEEP

49152:uxAUjfZ+AnOsIOyocA+YwZavG/Mfow7HSG5RXE10M97MKcGt6I69DpL9PlIvuyJt:Q9gAnWoR+YMav5oUb5RaBptoJpLjOJcw

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Files

b2ce15fdc2b519d9a71fdc576dddd336a1b3a25335bc4ded9c8ec9120e92bbf1
.exe windows x86

Code Sign

74:57:6a:91:b1:77:dd:b9:4a:15:a1:49:1a:4d:a1:d2
Certificate

Issuer

CN=Acer Quik AP527-57 [AN527-27-77M3]

Not Before

06-04-2023 15:02

Not After

07-04-2033 15:02

Subject

CN=Acer Quik AP527-57 [AN527-27-77M3]

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03-05-2023 00:00

Not After

02-08-2034 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

98:98:57:ee:d1:f8:9c:e3:d7:4c:0c:3c:5d:2b:dd:da:d9:ad:61:3a:2b:cf:f6:96:75:63:66:af:bd:92:8e:2d
Signer

Actual PE Digest

98:98:57:ee:d1:f8:9c:e3:d7:4c:0c:3c:5d:2b:dd:da:d9:ad:61:3a:2b:cf:f6:96:75:63:66:af:bd:92:8e:2d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 348KB - Virtual size: 440KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 129KB - Virtual size: 129KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.themida
Size: - Virtual size: 3.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

74:57:6a:91:b1:77:dd:b9:4a:15:a1:49:1a:4d:a1:d2Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

98:98:57:ee:d1:f8:9c:e3:d7:4c:0c:3c:5d:2b:dd:da:d9:ad:61:3a:2b:cf:f6:96:75:63:66:af:bd:92:8e:2dSigner

Headers

DLL Characteristics

File Characteristics

Sections

Size: 348KB - Virtual size: 440KB

.rsrc Size: 129KB - Virtual size: 129KB

Size: 512B - Virtual size: 12B

.idata Size: 512B - Virtual size: 8KB

.themida Size: - Virtual size: 3.7MB

.boot Size: 2.3MB - Virtual size: 2.3MB

74:57:6a:91:b1:77:dd:b9:4a:15:a1:49:1a:4d:a1:d2
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

98:98:57:ee:d1:f8:9c:e3:d7:4c:0c:3c:5d:2b:dd:da:d9:ad:61:3a:2b:cf:f6:96:75:63:66:af:bd:92:8e:2d
Signer

.rsrc
Size: 129KB - Virtual size: 129KB

.idata
Size: 512B - Virtual size: 8KB

.themida
Size: - Virtual size: 3.7MB

.boot
Size: 2.3MB - Virtual size: 2.3MB