7699ddeba95bec313633b0b1c520509d

Sharing

Copy URL Twitter E-mail

General

Target

7699ddeba95bec313633b0b1c520509d
Size

1.9MB
MD5

7699ddeba95bec313633b0b1c520509d
SHA1

ff78c091a9144cf6df1568b815acf9bcc459171d
SHA256

074cc4fca955712be947cf59a8265fa79d9eea6de31d64240905ecb4bcff3774
SHA512

45b37ed1810a194d8a4ea63b0f2d39bc420156643518bcab287995d65c5694b0c39b27457390c46e2a1d23e1517b9effed2887f10e236e14a0aed82bc51d2569
SSDEEP

49152:Yll6vLGYUbkPLz6tvmSJfHSFLdkiQmYJOo2UufqYs:el6zGDK36tuSJfHSFLdkRkpfps

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Files

7699ddeba95bec313633b0b1c520509d
.exe windows:4 windows x86 arch:x86

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:07:70:5f:a0:e0:c4:82:7c:c2:87:cf:cd:ec:20:c4
Certificate

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

21/09/2020, 00:00

Not After

29/09/2021, 12:00

Subject

SERIALNUMBER=326889,CN=Binance Holdings Limited,O=Binance Holdings Limited,L=George Town,C=KY,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b59

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:07:70:5f:a0:e0:c4:82:7c:c2:87:cf:cd:ec:20:c4
Certificate

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

21/09/2020, 00:00

Not After

29/09/2021, 12:00

Subject

SERIALNUMBER=326889,CN=Binance Holdings Limited,O=Binance Holdings Limited,L=George Town,C=KY,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b59

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:9d:16:4d:28:66:eb:bf:b4:7c:a4:52:c3:df:b9:e4:64:2a:fc:f3:ba:c6:86:a3:98:7f:86:7a:70:e3:9a:9a
Signer

Actual PE Digest

06:9d:16:4d:28:66:eb:bf:b4:7c:a4:52:c3:df:b9:e4:64:2a:fc:f3:ba:c6:86:a3:98:7f:86:7a:70:e3:9a:9a

Digest Algorithm

sha256

PE Digest Matches

false

fd:b5:de:17:0a:e3:3c:e6:dd:c9:aa:0b:19:25:87:22:6a:ad:b0:e0
Signer

Actual PE Digest

fd:b5:de:17:0a:e3:3c:e6:dd:c9:aa:0b:19:25:87:22:6a:ad:b0:e0

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 38KB - Virtual size: 112KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 14KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 1024B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.vm_sec
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 4.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

0d:07:70:5f:a0:e0:c4:82:7c:c2:87:cf:cd:ec:20:c4Certificate

Extended Key Usages

Key Usages

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06Certificate

Extended Key Usages

Key Usages

0d:07:70:5f:a0:e0:c4:82:7c:c2:87:cf:cd:ec:20:c4Certificate

Extended Key Usages

Key Usages

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06Certificate

Extended Key Usages

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

06:9d:16:4d:28:66:eb:bf:b4:7c:a4:52:c3:df:b9:e4:64:2a:fc:f3:ba:c6:86:a3:98:7f:86:7a:70:e3:9a:9aSigner

fd:b5:de:17:0a:e3:3c:e6:dd:c9:aa:0b:19:25:87:22:6a:ad:b0:e0Signer

Headers

DLL Characteristics

File Characteristics

Sections

Size: 38KB - Virtual size: 112KB

Size: 14KB - Virtual size: 67KB

Size: 1024B - Virtual size: 12B

.vm_sec Size: 16KB - Virtual size: 16KB

.idata Size: 1024B - Virtual size: 8KB

.rsrc Size: 68KB - Virtual size: 67KB

.themida Size: - Virtual size: 4.3MB

.boot Size: 1.8MB - Virtual size: 1.8MB

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

0d:07:70:5f:a0:e0:c4:82:7c:c2:87:cf:cd:ec:20:c4
Certificate

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Certificate

0d:07:70:5f:a0:e0:c4:82:7c:c2:87:cf:cd:ec:20:c4
Certificate

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

06:9d:16:4d:28:66:eb:bf:b4:7c:a4:52:c3:df:b9:e4:64:2a:fc:f3:ba:c6:86:a3:98:7f:86:7a:70:e3:9a:9a
Signer

fd:b5:de:17:0a:e3:3c:e6:dd:c9:aa:0b:19:25:87:22:6a:ad:b0:e0
Signer

.vm_sec
Size: 16KB - Virtual size: 16KB

.idata
Size: 1024B - Virtual size: 8KB

.rsrc
Size: 68KB - Virtual size: 67KB

.themida
Size: - Virtual size: 4.3MB

.boot
Size: 1.8MB - Virtual size: 1.8MB