2ab8ef039f4fa7211088f4c13696a435

Sharing

Copy URL Twitter E-mail

General

Target

2ab8ef039f4fa7211088f4c13696a435
Size

2.4MB
MD5

2ab8ef039f4fa7211088f4c13696a435
SHA1

f78be73590ee8bb467049ef37e14e03ade48fe5d
SHA256

707fc4fc688c96d954d98c839a60b3823d2bf5d51efea60121681b843fee5fdc
SHA512

eb7df3348e9864c310091f01ab3e0f892a7f84d8d6eebfb3d287308016505d1df6dfaf82bfb4316c4cda0d363b3b10cca13f03e9d33e2a0b06c2122756e7a318
SSDEEP

49152:WcqvQdf5IGPImxanOggxowVFvVBrc+xGYQxcwC:aIpPNGB2vOKMC

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Files

2ab8ef039f4fa7211088f4c13696a435
.exe windows:4 windows x86 arch:x86

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:92:c2:41:54:51:ab:12:07:40:4e:95:55:78:88:13
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

30/08/2018, 00:00

Not After

07/09/2021, 12:00

Subject

CN=Exodus Movement Inc,O=Exodus Movement Inc,L=Wilmington,ST=Delaware,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

34:40:ba:3d:b2:8c:04:09:4f:70:59:9e:ea:b8:1d:90:92:71:1f:1f:6f:e0:d1:36:cb:c6:17:14:cd:5f:ae:11
Signer

Actual PE Digest

34:40:ba:3d:b2:8c:04:09:4f:70:59:9e:ea:b8:1d:90:92:71:1f:1f:6f:e0:d1:36:cb:c6:17:14:cd:5f:ae:11

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 35KB - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 136KB - Virtual size: 275KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 1024B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.vm_sec
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 276KB - Virtual size: 275KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 4.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0f:92:c2:41:54:51:ab:12:07:40:4e:95:55:78:88:13Certificate

Extended Key Usages

Key Usages

34:40:ba:3d:b2:8c:04:09:4f:70:59:9e:ea:b8:1d:90:92:71:1f:1f:6f:e0:d1:36:cb:c6:17:14:cd:5f:ae:11Signer

Headers

DLL Characteristics

File Characteristics

Sections

Size: 35KB - Virtual size: 96KB

Size: 136KB - Virtual size: 275KB

Size: 1024B - Virtual size: 12B

.vm_sec Size: 16KB - Virtual size: 16KB

.idata Size: 1024B - Virtual size: 8KB

.rsrc Size: 276KB - Virtual size: 275KB

.themida Size: - Virtual size: 4.5MB

.boot Size: 2.0MB - Virtual size: 2.0MB

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0f:92:c2:41:54:51:ab:12:07:40:4e:95:55:78:88:13
Certificate

34:40:ba:3d:b2:8c:04:09:4f:70:59:9e:ea:b8:1d:90:92:71:1f:1f:6f:e0:d1:36:cb:c6:17:14:cd:5f:ae:11
Signer

.vm_sec
Size: 16KB - Virtual size: 16KB

.idata
Size: 1024B - Virtual size: 8KB

.rsrc
Size: 276KB - Virtual size: 275KB

.themida
Size: - Virtual size: 4.5MB

.boot
Size: 2.0MB - Virtual size: 2.0MB