861d2753dff5452685a2b9a353835634

Sharing

Copy URL Twitter E-mail

General

Target

861d2753dff5452685a2b9a353835634
Size

4.4MB
MD5

861d2753dff5452685a2b9a353835634
SHA1

1cc438e5c4b8ab4294b32a64638bf7147bc15a53
SHA256

82e756732682c24ec2a8c21a45761dc6c0a173b10ac6ed2f583ca92d78ba887a
SHA512

d0ba29240ce6331b89fffc5dc19bac5e6267119dd1cf5ebe7ef894d1ac58118f5d54118e87a9de115e680c19d0b29f69bc080f68525411d203f78ffa4d3dadbe
SSDEEP

98304:t1TUAdSX+jd2j/DC5fqQZdVXIywK64DVcvqNtTmaTd7/649bhITVm0:tN3y+x2GqQZzXfQnqNtTmUdz68h/0

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Files

861d2753dff5452685a2b9a353835634
.exe windows:4 windows x86 arch:x86

Code Sign

35:c1:24:ac:6a:f0:55:aa:45:ea:d8:53:66:ca:78:3d
Certificate

Issuer

CN=HP EliteDesk 800 G6 TWR

Not Before

01/08/2021, 17:24

Not After

02/08/2031, 17:24

Subject

CN=HP EliteDesk 800 G6 TWR

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23/10/2020, 00:00

Not After

22/01/2032, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

51:2f:4a:95:46:8e:b9:a7:16:ef:88:34:ce:da:a6:cf:9d:89:11:a5:64:94:67:d0:0a:71:0f:cb:38:de:24:ce
Signer

Actual PE Digest

51:2f:4a:95:46:8e:b9:a7:16:ef:88:34:ce:da:a6:cf:9d:89:11:a5:64:94:67:d0:0a:71:0f:cb:38:de:24:ce

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 78KB - Virtual size: 184KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 1.1MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

6️⃣
Size: 102KB - Virtual size: 102KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 5.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

6️⃣
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

6️⃣
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 102KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

35:c1:24:ac:6a:f0:55:aa:45:ea:d8:53:66:ca:78:3dCertificate

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

51:2f:4a:95:46:8e:b9:a7:16:ef:88:34:ce:da:a6:cf:9d:89:11:a5:64:94:67:d0:0a:71:0f:cb:38:de:24:ceSigner

Headers

DLL Characteristics

File Characteristics

Sections

Size: 78KB - Virtual size: 184KB

Size: 1.1MB - Virtual size: 1.2MB

Size: 512B - Virtual size: 12B

.idata Size: 512B - Virtual size: 8KB

6️⃣ Size: 102KB - Virtual size: 102KB

.themida Size: - Virtual size: 5.9MB

.boot Size: 3.0MB - Virtual size: 3.0MB

6️⃣ Size: 2KB - Virtual size: 2KB

6️⃣ Size: 2KB - Virtual size: 2KB

.rsrc Size: 102KB - Virtual size: 101KB

35:c1:24:ac:6a:f0:55:aa:45:ea:d8:53:66:ca:78:3d
Certificate

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

51:2f:4a:95:46:8e:b9:a7:16:ef:88:34:ce:da:a6:cf:9d:89:11:a5:64:94:67:d0:0a:71:0f:cb:38:de:24:ce
Signer

.idata
Size: 512B - Virtual size: 8KB

6️⃣
Size: 102KB - Virtual size: 102KB

.themida
Size: - Virtual size: 5.9MB

.boot
Size: 3.0MB - Virtual size: 3.0MB

6️⃣
Size: 2KB - Virtual size: 2KB

6️⃣
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 102KB - Virtual size: 101KB