1e772704f326b46a840e021e13ec7a63

Sharing

Copy URL Twitter E-mail

General

Target

1e772704f326b46a840e021e13ec7a63
Size

1.9MB
MD5

1e772704f326b46a840e021e13ec7a63
SHA1

3edebe050240482e34939ad29ace4dce9a2acea9
SHA256

0f493db9e705e43ddb8694769c1cb6393bc68bc921efc3f9603f8f71e66e74a1
SHA512

668c962344f5578a8961500d441eb18d3ea70b1bb47ab15a4ec580422a77a6d234cc4c2224c344e91673c9a29e9115324752c97d20e76472223fadbb069ebf8b
SSDEEP

49152:kzGurIi739jQBqINjPVhKaOth8bTDudU/GIkwUcIdCMeQNPNCWq:kzG1OQQItV/Ycnum/UbfesPN6

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Files

1e772704f326b46a840e021e13ec7a63
.exe windows:4 windows x86 arch:x86

Code Sign

46:56:da:a8:b8:b1:f3:e9:4b:b8:db:c4:6b:50:26:c6
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

07/12/2016, 00:00

Not After

07/12/2019, 23:59

Subject

CN=JWTS,O=JWTS,POSTALCODE=75015,STREET=105 RUE DE L ABBE GROULT,L=Paris,ST=Paris,C=FR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2d:ca:db:11:d0:f0:f4:e3:22:21:b3:a8:fb:d6:54:42:bf:5a:16:67:30:44:af:10:1c:d1:a0:f4:bf:cb:a1:49
Signer

Actual PE Digest

2d:ca:db:11:d0:f0:f4:e3:22:21:b3:a8:fb:d6:54:42:bf:5a:16:67:30:44:af:10:1c:d1:a0:f4:bf:cb:a1:49

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 35KB - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 1024B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.vm_sec
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 4.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

46:56:da:a8:b8:b1:f3:e9:4b:b8:db:c4:6b:50:26:c6Certificate

Extended Key Usages

Key Usages

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41Certificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

2d:ca:db:11:d0:f0:f4:e3:22:21:b3:a8:fb:d6:54:42:bf:5a:16:67:30:44:af:10:1c:d1:a0:f4:bf:cb:a1:49Signer

Headers

DLL Characteristics

File Characteristics

Sections

Size: 35KB - Virtual size: 96KB

Size: 27KB - Virtual size: 27KB

Size: 1024B - Virtual size: 12B

.vm_sec Size: 16KB - Virtual size: 16KB

.idata Size: 1024B - Virtual size: 8KB

.rsrc Size: 28KB - Virtual size: 28KB

.themida Size: - Virtual size: 4.3MB

.boot Size: 1.7MB - Virtual size: 1.7MB

46:56:da:a8:b8:b1:f3:e9:4b:b8:db:c4:6b:50:26:c6
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

2d:ca:db:11:d0:f0:f4:e3:22:21:b3:a8:fb:d6:54:42:bf:5a:16:67:30:44:af:10:1c:d1:a0:f4:bf:cb:a1:49
Signer

.vm_sec
Size: 16KB - Virtual size: 16KB

.idata
Size: 1024B - Virtual size: 8KB

.rsrc
Size: 28KB - Virtual size: 28KB

.themida
Size: - Virtual size: 4.3MB

.boot
Size: 1.7MB - Virtual size: 1.7MB