a0a0b63147fdaf7289d12bdbe5ae2311[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
a0a0b63147fdaf7289d12bdbe5ae2311.bin
Size 3.9MB
Sample240208-dfc5xacb93
SHA256 a2b641625c0417d7e4e9a01887af278b7d12a4babd28095c4b81cacc52207822
MD5 ae04656eecda42aec95d3011c5b9ab78
SHA1 8c7928baa4e6980b05261bf7d14a4e202ea48cf2
SHA512 7bdafe43c16375c2a6a23de85013a3397d91c76256670b22ab74be174a36729ee832fd79cb9ed957d2b406d19c2d0d1d107e7ea4d72ee49f74d7e728dab348bc
SSDEEP 98304:dzqc1QwDqf0rVMZsYBqY3BtuBKn6dm8Nij6x9hi8aW:9qcKcqs5Gtu46yBW
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
static1/unpack001/604813e7d8a8317ffb5682b51f172937b4866411d3011d4002f98a70de24f4fe.exe	themida

File Explorer

a0a0b63147fdaf7289d12bdbe5ae2311.bin

.zip 3.9MB
604813e7d8a8317ffb5682b51f172937b4866411d3011d4002f98a70de24f4fe.exe

.exe 4.2MB

a0a0b63147fdaf7289d12bdbe5ae2311.bin

SHA256 a2b641625c0417d7e4e9a01887af278b7d12a4babd28095c4b81cacc52207822
MD5 ae04656eecda42aec95d3011c5b9ab78
SHA1 8c7928baa4e6980b05261bf7d14a4e202ea48cf2
SHA512 7bdafe43c16375c2a6a23de85013a3397d91c76256670b22ab74be174a36729ee832fd79cb9ed957d2b406d19c2d0d1d107e7ea4d72ee49f74d7e728dab348bc
SSDEEP 98304:dzqc1QwDqf0rVMZsYBqY3BtuBKn6dm8Nij6x9hi8aW:9qcKcqs5Gtu46yBW
MD5 SHA1 SHA512 SSDEEP

Password

infected

604813e7d8a8317ffb5682b51f172937b4866411d3011d4002f98a70de24f4fe.exe

IMPHASH 2f7e9adabb08f758ed1accf0b8136028
SHA256 604813e7d8a8317ffb5682b51f172937b4866411d3011d4002f98a70de24f4fe
MD5 a0a0b63147fdaf7289d12bdbe5ae2311
SHA1 c28905eec0c9feea5df75b1cfee1a492a3bc22c8
SHA512 e912595e2b1c88e91a9c340b91f84872bb0f098d76f48376914323929713165c100ed6c4d73f602014e49f0ee1811f341e1c0d7d40242e7afa96967b43fccc93
SSDEEP 98304:8MizSuknr2on/thzNGIvVkKwsNfcR5F8Jr333:22nn1FpNGI60fE5F8J
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Themida packer

Detects Themida, an advanced Windows software protection system.

themida

Password

infected

PE Signature issue

Digest

6c:f1:a7:ba:6d:d7:2d:b1:d9:dc:13:4b:b9:14:ef:6f:19:37:50:56:43:af:93:78:c1:db:41:9d:2a:60:c3:5c

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›¹÷·B×êwõ%&ÒD›

Chains

Feb 6, 2024

Subject

Serial Number

64:81:46:83:03:ae:66:9c:48:30:0d:ac:63:af:2c:ac

Issuer

Timespan

Jan 10, 2024 - Jan 11, 2034

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 3, 2023 - Aug 2, 2034

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

7792866

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

Size

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

Virtual Size

290KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vmp€�

Size

Virtual Size

280KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.themida

Size

Virtual Size

4.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp€�

Size

Virtual Size

353KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp€�

Size

1024B

Virtual Size

960B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp€�

Size

3.9MB

Virtual Size

3.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_MEM_READ

Name

.rsrc

Size

234KB

Virtual Size

280KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

a0a0b63147fdaf7289d12bdbe5ae2311.bin

604813e7d8a8317ffb5682b51f172937b4866411d3011d4002f98a70de24f4fe.exe

PE Signature issue

kernel32

user32

advapi32

shell32

ole32

generic