541640b67b82757d460893b9386b812b

Sharing

Copy URL Twitter E-mail

General

Target

541640b67b82757d460893b9386b812b
Size

3.6MB
MD5

541640b67b82757d460893b9386b812b
SHA1

e5545c6cdb205864d81aa3c575366b36811edf33
SHA256

6e83d55ccff9ca4f2b642fdbe58704d65bb2f9ea4312051865a70a3ebb0d4140
SHA512

e40fe1b3af16b40e4ff3d42c158379b9dcc1f8ecae320cf355c942eb06878697f647c9739faf9266dfe6cb9e71e3dcc68b67b37f2b735caa050b32b54e265b16
SSDEEP

49152:1/VBZ/HIs48vzm0qX59ZZaNn8mUdQyfpdkVNWIao/7MRmc/9XpnO:JF/VBLV259PaNxUQkpdkVNWIafD/O

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Files

541640b67b82757d460893b9386b812b
.exe windows:4 windows x86 arch:x86

Code Sign

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2031, 00:00

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0b:c8:44:fc:76:05:6d:d6:92:6c:c0:e8:42:0d:db:74
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

13/08/2020, 00:00

Not After

18/08/2023, 12:00

Subject

CN=Dash Core Group Inc.,O=Dash Core Group Inc.,L=Scottsdale,ST=Arizona,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1e:03:cf:04:78:c4:6b:13:36:4b:b4:74:4a:94:62:c9:07:c4:e2:d9
Signer

Actual PE Digest

1e:03:cf:04:78:c4:6b:13:36:4b:b4:74:4a:94:62:c9:07:c4:e2:d9

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 91KB - Virtual size: 232KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Wifi 6
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.themida
Size: - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Wifi 6
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Wifi 6
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Wifi 6
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Wifi 6
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Wifi 6
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Wifi 6
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Wifi 6
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Wifi 6
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39Certificate

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0b:c8:44:fc:76:05:6d:d6:92:6c:c0:e8:42:0d:db:74Certificate

Extended Key Usages

Key Usages

1e:03:cf:04:78:c4:6b:13:36:4b:b4:74:4a:94:62:c9:07:c4:e2:d9Signer

Headers

DLL Characteristics

File Characteristics

Sections

Size: 91KB - Virtual size: 232KB

Wifi 6 Size: 1.2MB - Virtual size: 1.2MB

Size: 512B - Virtual size: 12B

.idata Size: 512B - Virtual size: 8KB

.themida Size: - Virtual size: 2.9MB

.boot Size: 1.1MB - Virtual size: 1.1MB

Wifi 6 Size: 3KB - Virtual size: 3KB

Wifi 6 Size: 3KB - Virtual size: 3KB

Wifi 6 Size: 3KB - Virtual size: 3KB

Wifi 6 Size: 3KB - Virtual size: 3KB

Wifi 6 Size: 3KB - Virtual size: 3KB

Wifi 6 Size: 3KB - Virtual size: 3KB

Wifi 6 Size: 3KB - Virtual size: 3KB

Wifi 6 Size: 3KB - Virtual size: 3KB

.rsrc Size: 1.2MB - Virtual size: 1.2MB

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0b:c8:44:fc:76:05:6d:d6:92:6c:c0:e8:42:0d:db:74
Certificate

1e:03:cf:04:78:c4:6b:13:36:4b:b4:74:4a:94:62:c9:07:c4:e2:d9
Signer

Wifi 6
Size: 1.2MB - Virtual size: 1.2MB

.idata
Size: 512B - Virtual size: 8KB

.themida
Size: - Virtual size: 2.9MB

.boot
Size: 1.1MB - Virtual size: 1.1MB

Wifi 6
Size: 3KB - Virtual size: 3KB

Wifi 6
Size: 3KB - Virtual size: 3KB

Wifi 6
Size: 3KB - Virtual size: 3KB

Wifi 6
Size: 3KB - Virtual size: 3KB

Wifi 6
Size: 3KB - Virtual size: 3KB

Wifi 6
Size: 3KB - Virtual size: 3KB

Wifi 6
Size: 3KB - Virtual size: 3KB

Wifi 6
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 1.2MB - Virtual size: 1.2MB