SecuriteInfo[.]com[.]W32[.]ClipBanker[.]BM[.]gen[.]Eldorado[.]29544[.]5170[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

SecuriteInfo.com.W32.ClipBanker.BM.gen.Eldorado.29544.5170.exe
Size

5.7MB
MD5

c0ef9d267c5557088c0724b75f1d10b5
SHA1

160a3a4bd2522bf2da9959d46bef2066d69b4e35
SHA256

2b4eb665e3459f0bad9d1564c0e9bcf603057c73996290344c92b6c42d6bc66d
SHA512

ec13ee5881737f0fef46b2657c5d5d40ebe7d52867063801cb9fdabc19ce062c22da799b1a1c7616024f835aee0b340d338abe8e08d64cda4f427ad162cf2031
SSDEEP

98304:Pl1miR1gYgNgqVpbTYVgZoj47MZ5FV0ZIvY4mQj1zvJvHfc10YS29F+bfbJBQJqP:ZgYgNvpbXZ778hsIvY6j15fc1S26TbvP

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Files

SecuriteInfo.com.W32.ClipBanker.BM.gen.Eldorado.29544.5170.exe
.exe windows:6 windows x86 arch:x86

4606041c7eb9dc2ea0c018ff25cd5fa6

Code Sign

6d:3e:11:99:42:e0:fa:b0:48:52:41:ac:c6:d3:90:32
Certificate

Issuer

CN=Hewlett-Packard Company /silver/

Not Before

18-11-2023 19:43

Not After

19-11-2033 19:43

Subject

CN=Hewlett-Packard Company /silver/

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03-05-2023 00:00

Not After

02-08-2034 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:72:78:44:af:2a:b4:46:fc:0b:57:69:f6:47:65:34:b3:d3:39:cb:15:10:5f:d0:54:50:9c:a5:76:a1:d3:ff
Signer

Actual PE Digest

08:72:78:44:af:2a:b4:46:fc:0b:57:69:f6:47:65:34:b3:d3:39:cb:15:10:5f:d0:54:50:9c:a5:76:a1:d3:ff

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

SetClipboardData

advapi32

RegSetValueExA

shell32

ShellExecuteExW

ole32

CoTaskMemFree

Sections

Size: - Virtual size: 162KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.imports
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Winzip0
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 3.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.Winzip1
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.³Zip³
Size: - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.³Zip³
Size: 1024B - Virtual size: 880B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.³Zip³
Size: 5.7MB - Virtual size: 5.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4606041c7eb9dc2ea0c018ff25cd5fa6

Code Sign

6d:3e:11:99:42:e0:fa:b0:48:52:41:ac:c6:d3:90:32Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

08:72:78:44:af:2a:b4:46:fc:0b:57:69:f6:47:65:34:b3:d3:39:cb:15:10:5f:d0:54:50:9c:a5:76:a1:d3:ffSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

Sections

Size: - Virtual size: 162KB

Size: - Virtual size: 67KB

Size: - Virtual size: 7KB

Size: - Virtual size: 1KB

Size: - Virtual size: 9KB

.imports Size: - Virtual size: 4KB

.Winzip0 Size: - Virtual size: 4KB

.themida Size: - Virtual size: 3.9MB

.boot Size: - Virtual size: 2.4MB

.Winzip1 Size: - Virtual size: 1KB

.³Zip³ Size: - Virtual size: 2.0MB

.³Zip³ Size: 1024B - Virtual size: 880B

.³Zip³ Size: 5.7MB - Virtual size: 5.7MB

.reloc Size: 7KB - Virtual size: 6KB

.rsrc Size: 2KB - Virtual size: 2KB

6d:3e:11:99:42:e0:fa:b0:48:52:41:ac:c6:d3:90:32
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

08:72:78:44:af:2a:b4:46:fc:0b:57:69:f6:47:65:34:b3:d3:39:cb:15:10:5f:d0:54:50:9c:a5:76:a1:d3:ff
Signer

.imports
Size: - Virtual size: 4KB

.Winzip0
Size: - Virtual size: 4KB

.themida
Size: - Virtual size: 3.9MB

.boot
Size: - Virtual size: 2.4MB

.Winzip1
Size: - Virtual size: 1KB

.³Zip³
Size: - Virtual size: 2.0MB

.³Zip³
Size: 1024B - Virtual size: 880B

.³Zip³
Size: 5.7MB - Virtual size: 5.7MB

.reloc
Size: 7KB - Virtual size: 6KB

.rsrc
Size: 2KB - Virtual size: 2KB