567018eaa87d7e7f8e2eace7fbecc39f2e20782f81b9afa84f3e6fdefd575a12

Sharing

Copy URL Twitter E-mail

General

Target

567018eaa87d7e7f8e2eace7fbecc39f2e20782f81b9afa84f3e6fdefd575a12
Size

2.9MB
MD5

ad08acccfa7f4cdfe5f6d38c9adb3bf6
SHA1

7eb405e6072e9128ff715bffc075bd265f215837
SHA256

567018eaa87d7e7f8e2eace7fbecc39f2e20782f81b9afa84f3e6fdefd575a12
SHA512

2092482b310c4735afb019e56e1f4140226f6dd702eb7d6c50d6de481a3bba288171e82064f5f43c2b7187d7f1b7832bbc3ebcd4a81497a91eb228feb615753c
SSDEEP

49152:519XQ3hfDBYjUoY/HpbKrSsfxortkOYTtH8oPWIvYy6Ww7KeIUBq/AxhcYnfnP43:51dqRBYjUphu2Wxq2OYTGw76tWsB+Avm

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Files

567018eaa87d7e7f8e2eace7fbecc39f2e20782f81b9afa84f3e6fdefd575a12
.exe windows:4 windows x86 arch:x86

Code Sign

62:39:8e:ff:3c:5d:2f:a2:48:3b:35:43:f9:10:bf:e0
Certificate

Issuer

CN=◄⁂MZ⁂▶⬤◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZMZ⁂▶

Not Before

17/12/2023, 12:21

Not After

18/12/2033, 12:21

Subject

CN=◄⁂MZ⁂▶⬤◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZ⁂▶◄⁂MZMZ⁂▶

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

34:19:5e:3c:d6:96:db:a4:54:f5:3e:b7:dc:5f:c3:08:f2:91:81:29:88:65:e5:20:11:1e:25:25:67:42:93:d7
Signer

Actual PE Digest

34:19:5e:3c:d6:96:db:a4:54:f5:3e:b7:dc:5f:c3:08:f2:91:81:29:88:65:e5:20:11:1e:25:25:67:42:93:d7

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 97KB - Virtual size: 224KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 9KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 4.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

62:39:8e:ff:3c:5d:2f:a2:48:3b:35:43:f9:10:bf:e0Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

34:19:5e:3c:d6:96:db:a4:54:f5:3e:b7:dc:5f:c3:08:f2:91:81:29:88:65:e5:20:11:1e:25:25:67:42:93:d7Signer

Headers

DLL Characteristics

File Characteristics

Sections

Size: 97KB - Virtual size: 224KB

Size: 9KB - Virtual size: 19KB

Size: 512B - Virtual size: 12B

.idata Size: 512B - Virtual size: 8KB

.rsrc Size: 19KB - Virtual size: 19KB

.themida Size: - Virtual size: 4.1MB

.boot Size: 2.8MB - Virtual size: 2.8MB

62:39:8e:ff:3c:5d:2f:a2:48:3b:35:43:f9:10:bf:e0
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

34:19:5e:3c:d6:96:db:a4:54:f5:3e:b7:dc:5f:c3:08:f2:91:81:29:88:65:e5:20:11:1e:25:25:67:42:93:d7
Signer

.idata
Size: 512B - Virtual size: 8KB

.rsrc
Size: 19KB - Virtual size: 19KB

.themida
Size: - Virtual size: 4.1MB

.boot
Size: 2.8MB - Virtual size: 2.8MB