d86b530f1dcf5d9ac1b107aee3085d7dec763b4bcbeddabc0d64451d2eacc9e0

Sharing

Copy URL Twitter E-mail

General

Target

d86b530f1dcf5d9ac1b107aee3085d7dec763b4bcbeddabc0d64451d2eacc9e0
Size

4.5MB
MD5

6631032c2beab454ad2606bbb636117b
SHA1

f9a5a382024937d022fc49743e057efc0374fa4a
SHA256

b538294c4280d9990e7b21c4761cfab630ebafe44b05634c0be0c3089e35e0ed
SHA512

1a58b764eb85af04af629182b5a999cacc982ddd32da694d9498d1a7a93b5906aa8a39b3a5b2c8450696a070e559a81b70f292c944ace5171b7ab4bd33eff6d2
SSDEEP

98304:6YOH4yAQr166WQzhymXM9H9iEwBuczN9GBsJwLE0KmJ2:hOYyPr16pQzhEZOuc7GBsJwI0Ki2

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
static1/unpack001/d86b530f1dcf5d9ac1b107aee3085d7dec763b4bcbeddabc0d64451d2eacc9e0	themida

Files

d86b530f1dcf5d9ac1b107aee3085d7dec763b4bcbeddabc0d64451d2eacc9e0
.zip
d86b530f1dcf5d9ac1b107aee3085d7dec763b4bcbeddabc0d64451d2eacc9e0
.exe windows:6 windows x64

Code Sign

14:23:04:7e:c6:b4:11:6d:5e:32:6b:06:7a:ab:86:6f
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,OU=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

31/10/2023, 00:26

Not After

31/10/2024, 00:26

Subject

CN=Microsoft Code Signing PCA 2011,OU=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:18:fd:fe:55:09:31:45:6a:88:33:43:7b:38:b0:92:ef:91:42:45:77:06:a2:8d:3b:a4:1e:f9:78:51:ee:5a
Signer

Actual PE Digest

0a:18:fd:fe:55:09:31:45:6a:88:33:43:7b:38:b0:92:ef:91:42:45:77:06:a2:8d:3b:a4:1e:f9:78:51:ee:5a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Exports

Exports

DotNetRuntimeDebugHeader

Sections

Size: 197KB - Virtual size: 451KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 314KB - Virtual size: 711KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 286KB - Virtual size: 614KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 33KB - Virtual size: 171KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 41KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 190B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 582B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 10KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.exports
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.imports
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 6.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 3.7MB - Virtual size: 3.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 16B - Virtual size: 4KB

IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

14:23:04:7e:c6:b4:11:6d:5e:32:6b:06:7a:ab:86:6fCertificate

Extended Key Usages

Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

0a:18:fd:fe:55:09:31:45:6a:88:33:43:7b:38:b0:92:ef:91:42:45:77:06:a2:8d:3b:a4:1e:f9:78:51:ee:5aSigner

Headers

DLL Characteristics

File Characteristics

Exports

Exports

Sections

Size: 197KB - Virtual size: 451KB

Size: 314KB - Virtual size: 711KB

Size: 286KB - Virtual size: 614KB

Size: 33KB - Virtual size: 171KB

Size: 41KB - Virtual size: 71KB

Size: 190B - Virtual size: 348B

Size: 582B - Virtual size: 1KB

Size: 10KB - Virtual size: 37KB

.exports Size: 512B - Virtual size: 4KB

.imports Size: 1024B - Virtual size: 4KB

.tls Size: 512B - Virtual size: 4KB

.rsrc Size: 1KB - Virtual size: 4KB

.themida Size: - Virtual size: 6.1MB

.boot Size: 3.7MB - Virtual size: 3.7MB

.reloc Size: 16B - Virtual size: 4KB

14:23:04:7e:c6:b4:11:6d:5e:32:6b:06:7a:ab:86:6f
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

0a:18:fd:fe:55:09:31:45:6a:88:33:43:7b:38:b0:92:ef:91:42:45:77:06:a2:8d:3b:a4:1e:f9:78:51:ee:5a
Signer

.exports
Size: 512B - Virtual size: 4KB

.imports
Size: 1024B - Virtual size: 4KB

.tls
Size: 512B - Virtual size: 4KB

.rsrc
Size: 1KB - Virtual size: 4KB

.themida
Size: - Virtual size: 6.1MB

.boot
Size: 3.7MB - Virtual size: 3.7MB

.reloc
Size: 16B - Virtual size: 4KB