ElfScorePrint[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

ElfScorePrint.exe
Size

6.7MB
MD5

d371c2e84956e96ce0d45da6a7776687
SHA1

d09d41fd6468f90fc40f81bfaeebffe99a87536f
SHA256

c7f7890e8d1e92842f826e208b24862ab2134263de92f557a8711571e674d061
SHA512

d1fdf459128d4d63f22c1a0639f17872f2db5f89168969f29a79d9bb6d8ba164eff2e3258c65d0af8ee579a358a83a2249fa91c43e8b9fc57cfe401eb516e608
SSDEEP

98304:eAnP9uNPYYZ9RUTnSyiN+kGlMUwi/H/l5sEd4vAm+p6TRBIRishOA1t9BaoRl2UW:exNVRUTnS7YlWUwGwTRahhTtD2UF41

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Files

ElfScorePrint.exe
.exe windows x86

Code Sign

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

69:87:ca:31:6b:43:ac:89:aa:68:8a:93
Certificate

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

11/11/2022, 08:26

Not After

25/12/2024, 10:22

Subject

CN=ELF PROFESSIONAL CO.\,LTD,O=ELF PROFESSIONAL CO.\,LTD,L=Gangseo-gu,ST=Seoul,C=KR,1.2.840.113549.1.9.1=#0c137765626d617374657240656c662e636f2e6b72

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

06/04/2022, 07:44

Not After

08/05/2033, 07:44

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

20/02/2019, 00:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

b8:dc:08:cd:f5:48:6c:eb:23:82:6a:36:0f:f0:64:f9:93:9c:3c:4d:a2:db:c8:df:7c:d6:08:64:86:e2:86:3a
Signer

Actual PE Digest

b8:dc:08:cd:f5:48:6c:eb:23:82:6a:36:0f:f0:64:f9:93:9c:3c:4d:a2:db:c8:df:7c:d6:08:64:86:e2:86:3a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 1015KB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 105KB - Virtual size: 404KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 67KB - Virtual size: 286KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 2.3MB - Virtual size: 27.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 67KB - Virtual size: 485KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.imports
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 86KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 5.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.loadcon
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.boot
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 16B - Virtual size: 4KB

IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47Certificate

Extended Key Usages

Key Usages

69:87:ca:31:6b:43:ac:89:aa:68:8a:93Certificate

Extended Key Usages

Key Usages

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1dCertificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fcCertificate

Key Usages

04:00:00:00:00:01:21:58:53:08:a2Certificate

Key Usages

b8:dc:08:cd:f5:48:6c:eb:23:82:6a:36:0f:f0:64:f9:93:9c:3c:4d:a2:db:c8:df:7c:d6:08:64:86:e2:86:3aSigner

Headers

DLL Characteristics

File Characteristics

Sections

Size: 1015KB - Virtual size: 1.9MB

Size: 105KB - Virtual size: 404KB

Size: 67KB - Virtual size: 286KB

Size: 2.3MB - Virtual size: 27.8MB

Size: 67KB - Virtual size: 485KB

.imports Size: 1KB - Virtual size: 4KB

.rsrc Size: 86KB - Virtual size: 86KB

.themida Size: - Virtual size: 5.3MB

.loadcon Size: 4KB - Virtual size: 4KB

.boot Size: 3.1MB - Virtual size: 3.1MB

.reloc Size: 16B - Virtual size: 4KB

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47
Certificate

69:87:ca:31:6b:43:ac:89:aa:68:8a:93
Certificate

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

04:00:00:00:00:01:21:58:53:08:a2
Certificate

b8:dc:08:cd:f5:48:6c:eb:23:82:6a:36:0f:f0:64:f9:93:9c:3c:4d:a2:db:c8:df:7c:d6:08:64:86:e2:86:3a
Signer

.imports
Size: 1KB - Virtual size: 4KB

.rsrc
Size: 86KB - Virtual size: 86KB

.themida
Size: - Virtual size: 5.3MB

.loadcon
Size: 4KB - Virtual size: 4KB

.boot
Size: 3.1MB - Virtual size: 3.1MB

.reloc
Size: 16B - Virtual size: 4KB