fe97d934a13e218333f1dac19c841a3a[.]bin

Sharing

Copy URL Twitter E-mail

General

Target

fe97d934a13e218333f1dac19c841a3a.bin
Size

4.4MB
MD5

c3e819a570a2ff1894b198d20025825a
SHA1

e0fab027ab5c2d29678a233a9de4de18bab87acd
SHA256

cfb1047acb994bf9aafa7a3e9f3cdc2cafd8f377717cd043c4674f7f55a2bd2d
SHA512

e06bb72da271a793fe0d3ea867e9f6ec450e5d02338f62986888ee9fa3f8e9b314738ba180a4f815cb07353c0d163afc1a961fc1ca3f36de171b5d931f392c0a
SSDEEP

98304:9tJRHaUKT9aLeSfjGPtz6KLdnuKpFGSVBKxF1PTD+Sq8H5QF:9hHaH9ueSfyPJ6CnHLyl1ty

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
static1/unpack001/c42e2b04f2acfc9c7a098d705762b79bdc6a03281be8e5c6ad534ccd792a2448.exe	themida

Files

fe97d934a13e218333f1dac19c841a3a.bin
.zip

Password: infected
c42e2b04f2acfc9c7a098d705762b79bdc6a03281be8e5c6ad534ccd792a2448.exe
.exe windows:6 windows x64

Password: infected

Code Sign

e0:5b:29:08:e7:51:27:93:16:2a:d2:58:de:87:cc:e1
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,OU=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

30/10/2023, 14:48

Not After

30/10/2024, 14:48

Subject

CN=Microsoft Code Signing PCA 2011,OU=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6f:88:e9:62:b2:f4:fe:64:b9:5d:7b:f6:18:c8:39:0c:38:14:cd:e3:64:8b:ea:de:02:d1:27:9e:a6:a1:e4:90
Signer

Actual PE Digest

6f:88:e9:62:b2:f4:fe:64:b9:5d:7b:f6:18:c8:39:0c:38:14:cd:e3:64:8b:ea:de:02:d1:27:9e:a6:a1:e4:90

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Exports

Exports

DotNetRuntimeDebugHeader

Sections

Size: 197KB - Virtual size: 451KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 314KB - Virtual size: 711KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 402KB - Virtual size: 756KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 33KB - Virtual size: 171KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 41KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 190B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 531B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 10KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.exports
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.imports
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 5.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 16B - Virtual size: 4KB

IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

Code Sign

e0:5b:29:08:e7:51:27:93:16:2a:d2:58:de:87:cc:e1Certificate

Extended Key Usages

Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

6f:88:e9:62:b2:f4:fe:64:b9:5d:7b:f6:18:c8:39:0c:38:14:cd:e3:64:8b:ea:de:02:d1:27:9e:a6:a1:e4:90Signer

Headers

DLL Characteristics

File Characteristics

Exports

Exports

Sections

Size: 197KB - Virtual size: 451KB

Size: 314KB - Virtual size: 711KB

Size: 402KB - Virtual size: 756KB

Size: 33KB - Virtual size: 171KB

Size: 41KB - Virtual size: 71KB

Size: 190B - Virtual size: 348B

Size: 531B - Virtual size: 1008B

Size: 10KB - Virtual size: 37KB

.exports Size: 512B - Virtual size: 4KB

.imports Size: 1024B - Virtual size: 4KB

.tls Size: 512B - Virtual size: 4KB

.rsrc Size: 1024B - Virtual size: 4KB

.themida Size: - Virtual size: 5.9MB

.boot Size: 3.4MB - Virtual size: 3.4MB

.reloc Size: 16B - Virtual size: 4KB

e0:5b:29:08:e7:51:27:93:16:2a:d2:58:de:87:cc:e1
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

6f:88:e9:62:b2:f4:fe:64:b9:5d:7b:f6:18:c8:39:0c:38:14:cd:e3:64:8b:ea:de:02:d1:27:9e:a6:a1:e4:90
Signer

.exports
Size: 512B - Virtual size: 4KB

.imports
Size: 1024B - Virtual size: 4KB

.tls
Size: 512B - Virtual size: 4KB

.rsrc
Size: 1024B - Virtual size: 4KB

.themida
Size: - Virtual size: 5.9MB

.boot
Size: 3.4MB - Virtual size: 3.4MB

.reloc
Size: 16B - Virtual size: 4KB