a9ef0a36e9924f9742af01b648d7c89624e1e360716adb8fe7f58a6f28c4865e

Sharing

Copy URL

Twitter E-mail

General

Target

a9ef0a36e9924f9742af01b648d7c89624e1e360716adb8fe7f58a6f28c4865e
Size

3.0MB
MD5

f4cb9c8b7e02e8084008cd61e1899390
SHA1

af1a95a823a8c24cab9d8e8aaf46d69b3612dd4b
SHA256

a9ef0a36e9924f9742af01b648d7c89624e1e360716adb8fe7f58a6f28c4865e
SHA512

e808e95a5f57a13e61f8b77502f0f01c7faf66f2663d4de0b61a308f39520da8d649f32ed886edf446eefd88cf324854bcca059f8c0a6f46148388242e6b65b6
SSDEEP

49152:a3xvpi1/ddAPDmHnK0jtdMH93Oi4bLvjVyFmftLs0rYKbSDKHHU0zFTL7TBaS:a3xvi/AcKQCJALvjBfpfe+9JPRb

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Files

a9ef0a36e9924f9742af01b648d7c89624e1e360716adb8fe7f58a6f28c4865e
.exe windows:4 windows x86 arch:x86

Code Sign

4e:04:2c:42:f9:de:68:8e:4a:6f:c2:f8:41:40:d4:f9
Certificate

Issuer

CN=Logitech H153 Wired Headset Black 2.0 overhead 20 Hz - 20000 Hz 22Ω corded cable - 1.8 m

Not Before

23-11-2023 09:28

Not After

24-11-2033 09:28

Subject

CN=Logitech H153 Wired Headset Black 2.0 overhead 20 Hz - 20000 Hz 22Ω corded cable - 1.8 m

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03-05-2023 00:00

Not After

02-08-2034 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6a:18:25:80:f2:49:f4:1d:b4:a5:72:08:5a:1d:d5:1d:e7:c4:91:35:30:9b:ad:f5:1e:66:22:4d:d7:29:77:b7
Signer

Actual PE Digest

6a:18:25:80:f2:49:f4:1d:b4:a5:72:08:5a:1d:d5:1d:e7:c4:91:35:30:9b:ad:f5:1e:66:22:4d:d7:29:77:b7

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 69KB - Virtual size: 176KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 411KB - Virtual size: 411KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.themida
Size: - Virtual size: 5.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

4e:04:2c:42:f9:de:68:8e:4a:6f:c2:f8:41:40:d4:f9Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

6a:18:25:80:f2:49:f4:1d:b4:a5:72:08:5a:1d:d5:1d:e7:c4:91:35:30:9b:ad:f5:1e:66:22:4d:d7:29:77:b7Signer

Headers

DLL Characteristics

File Characteristics

Sections

Size: 69KB - Virtual size: 176KB

.rsrc Size: 411KB - Virtual size: 411KB

Size: 512B - Virtual size: 12B

.idata Size: 512B - Virtual size: 8KB

.themida Size: - Virtual size: 5.5MB

.boot Size: 2.5MB - Virtual size: 2.5MB

4e:04:2c:42:f9:de:68:8e:4a:6f:c2:f8:41:40:d4:f9
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

6a:18:25:80:f2:49:f4:1d:b4:a5:72:08:5a:1d:d5:1d:e7:c4:91:35:30:9b:ad:f5:1e:66:22:4d:d7:29:77:b7
Signer

.rsrc
Size: 411KB - Virtual size: 411KB

.idata
Size: 512B - Virtual size: 8KB

.themida
Size: - Virtual size: 5.5MB

.boot
Size: 2.5MB - Virtual size: 2.5MB