9097086a618c5e822fb63456873e763d[.]bin

Sharing

Copy URL Twitter E-mail

General

Target

9097086a618c5e822fb63456873e763d.bin
Size

4.7MB
MD5

9097086a618c5e822fb63456873e763d
SHA1

6d60ab01dea93a1fe9fc1f41c837420e3f91a5df
SHA256

a9e6b9acb3f74abf0583a5552591a22eb279fe3f96f9316ec4449bd9d7116030
SHA512

86023224e5e13f5edf4a3e587cb25f6a46a24202adfad019babb70096175dc9417747168b19becc78aa683e35c351f99d3b154072ca95909f5ddd7b9ffd98b41
SSDEEP

98304:rhS83IiYHlnC7H+kvke8Ykrr0cxnCKe1BvUdkzhcTgBKGNs+YgX3rZwDqm:tS84iYFnC7H/vR8VrgcwjvDWTgcGi+dY

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Files

9097086a618c5e822fb63456873e763d.bin
.exe windows:6 windows x86 arch:x86

734547d3d163f7986e9db3d8edd47085

Code Sign

6b:40:a0:60:e0:60:f7:8b:48:98:76:ee:0c:98:5c:85
Certificate

Issuer

CN=Published under the GNU GPL r€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒ

Not Before

02/01/2024, 19:44

Not After

03/01/2034, 19:44

Subject

CN=Published under the GNU GPL r€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒr€@�¡ @�ƒ

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:ec:8b:03:23:7b:4d:d5:7e:7e:be:d2:48:af:bb:d2:6c:5f:36:7c:8d:71:f8:72:01:62:ac:e8:e4:c0:f7:d6
Signer

Actual PE Digest

1d:ec:8b:03:23:7b:4d:d5:7e:7e:be:d2:48:af:bb:d2:6c:5f:36:7c:8d:71:f8:72:01:62:ac:e8:e4:c0:f7:d6

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

GetSystemMetrics

gdi32

CreateCompatibleBitmap

advapi32

RegCloseKey

shell32

SHGetFolderPathA

wininet

HttpOpenRequestA

gdiplus

GdiplusStartup

ws2_32

closesocket

Sections

Size: - Virtual size: 330KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp°>�
Size: - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 4.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp°>�
Size: - Virtual size: 956KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp°>�
Size: 512B - Virtual size: 492B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp°>�
Size: 4.7MB - Virtual size: 4.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_MEM_READ

.rsrc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

734547d3d163f7986e9db3d8edd47085

Code Sign

6b:40:a0:60:e0:60:f7:8b:48:98:76:ee:0c:98:5c:85Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

1d:ec:8b:03:23:7b:4d:d5:7e:7e:be:d2:48:af:bb:d2:6c:5f:36:7c:8d:71:f8:72:01:62:ac:e8:e4:c0:f7:d6Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

wininet

gdiplus

ws2_32

Sections

Size: - Virtual size: 330KB

Size: - Virtual size: 71KB

Size: - Virtual size: 17KB

Size: - Virtual size: 99KB

Size: - Virtual size: 19KB

.idata Size: - Virtual size: 4KB

.tls Size: - Virtual size: 4KB

.vmp°>� Size: - Virtual size: 15KB

.themida Size: - Virtual size: 4.1MB

.boot Size: - Virtual size: 2.2MB

.vmp°>� Size: - Virtual size: 956KB

.vmp°>� Size: 512B - Virtual size: 492B

.vmp°>� Size: 4.7MB - Virtual size: 4.7MB

.reloc Size: 7KB - Virtual size: 6KB

.rsrc Size: 14KB - Virtual size: 14KB

6b:40:a0:60:e0:60:f7:8b:48:98:76:ee:0c:98:5c:85
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

1d:ec:8b:03:23:7b:4d:d5:7e:7e:be:d2:48:af:bb:d2:6c:5f:36:7c:8d:71:f8:72:01:62:ac:e8:e4:c0:f7:d6
Signer

.idata
Size: - Virtual size: 4KB

.tls
Size: - Virtual size: 4KB

.vmp°>�
Size: - Virtual size: 15KB

.themida
Size: - Virtual size: 4.1MB

.boot
Size: - Virtual size: 2.2MB

.vmp°>�
Size: - Virtual size: 956KB

.vmp°>�
Size: 512B - Virtual size: 492B

.vmp°>�
Size: 4.7MB - Virtual size: 4.7MB

.reloc
Size: 7KB - Virtual size: 6KB

.rsrc
Size: 14KB - Virtual size: 14KB