6e0a53a9819650d36cbd914e39bc7db4

Sharing

Copy URL Twitter E-mail

General

Target
6e0a53a9819650d36cbd914e39bc7db4
Size 2.6MB
Sample231219-wctycsacc2
SHA256 bee34a2bd644d414dd4dbf6d2e478d46174056ea589ed2370638fb56373c562c
MD5 6e0a53a9819650d36cbd914e39bc7db4
SHA1 d8a22bbac4089785eac1bce74cd7d3bc9d9c3737
SHA512 1a8524249093852e20b3700fd96d8b5f52d2149e520c873a49a05f4e915bc89509d5ce87eeb18d3e4fed4701697ff78ae0e06eccdc3466437331429b078c1a58
SSDEEP 49152:SH5Ucu7CPNHNFPBX11TkBqu4v/XUETb4zl9cN81MUWA6qG1+lu5g3rMwHBe3Zf5m:+3ugNLLT1Vvct7q9A6qG1erloPRm
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

File Explorer

6e0a53a9819650d36cbd914e39bc7db4

.exe 2.6MB

6e0a53a9819650d36cbd914e39bc7db4

SHA256 bee34a2bd644d414dd4dbf6d2e478d46174056ea589ed2370638fb56373c562c
MD5 6e0a53a9819650d36cbd914e39bc7db4
SHA1 d8a22bbac4089785eac1bce74cd7d3bc9d9c3737
SHA512 1a8524249093852e20b3700fd96d8b5f52d2149e520c873a49a05f4e915bc89509d5ce87eeb18d3e4fed4701697ff78ae0e06eccdc3466437331429b078c1a58
SSDEEP 49152:SH5Ucu7CPNHNFPBX11TkBqu4v/XUETb4zl9cN81MUWA6qG1+lu5g3rMwHBe3Zf5m:+3ugNLLT1Vvct7q9A6qG1erloPRm
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Themida packer

Detects Themida, an advanced Windows software protection system.

themida

PE Signature issue

Digest

2c:09:da:42:99:c9:df:90:ef:c4:11:e6:c1:37:c0:af:91:ae:2b:b8:01:24:76:54:27:31:2d:c8:13:fa:fc:1c

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=155628861,CN=TEFINCOM S.A.,O=TEFINCOM S.A.,STREET=50th Street\, Global Plaza Tower\, 19th Floor\, Suite H,L=Panama,ST=Panama,C=PA,1.2.840.113549.1.9.1=#0c1161646d696e406e6f726476706e2e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13025041,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Apr 26, 2021

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

Serial Number

7b:0f:70:49:63:4b:d8:fd:7f:77:a5:80

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 14, 2019 - Jun 13, 2021

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:35:01:ea:17:c5:39:29:8d:be:59:1e:52:8b:f6:60

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Feb 2, 2021 - Mar 6, 2032

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 20, 2019 - Mar 18, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Minor OS version

Major OS version

Entry point

4611256

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

Size

101KB

Virtual Size

209KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

19KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

1024B

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

7KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.idata

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

6e0a53a9819650d36cbd914e39bc7db4

PE Signature issue

generic