34d9359a2a6b15423c74298520282b9b[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
34d9359a2a6b15423c74298520282b9b.exe
Size 7.5MB
Sample240315-pl66qagc5t
SHA256 c24ff96b950f3bff58f53396fe1aae0764209db72ee6489abffeba8855a7bd3f
MD5 34d9359a2a6b15423c74298520282b9b
SHA1 994219595e6e352add2e70188f5ff8cce111fb63
SHA512 880a831cadeaddb040523b21724949b3cb444bb823421b4a5b0f0be8cc8255108a57547b5c18a0877121a8cd4e7c7857afae4e952e4dadf200de10546bb95950
SSDEEP 196608:VKFPXI1QmlVDuauMb5EVFOUIjKlEPCw0517qAZiP:VW41v9uMt5RKSPy17qws
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
static1/unpack001/⌚/sfasfafs.exe	themida

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
34d9359a2a6b15423c74298520282b9b.exe
unpack001/⌚/crypt.exe
unpack001/⌚/sfasfafs.exe

File Explorer

34d9359a2a6b15423c74298520282b9b.exe

.exe 7.5MB
⌚/38.exe

.exe 4.5MB
⌚/crypt.exe

.exe 412KB
⌚/sfasfafs.exe

.exe 5.2MB

34d9359a2a6b15423c74298520282b9b.exe

IMPHASH 9dda1a1d1f8a1d13ae0297b47046b26e
SHA256 c24ff96b950f3bff58f53396fe1aae0764209db72ee6489abffeba8855a7bd3f
MD5 34d9359a2a6b15423c74298520282b9b
SHA1 994219595e6e352add2e70188f5ff8cce111fb63
SHA512 880a831cadeaddb040523b21724949b3cb444bb823421b4a5b0f0be8cc8255108a57547b5c18a0877121a8cd4e7c7857afae4e952e4dadf200de10546bb95950
SSDEEP 196608:VKFPXI1QmlVDuauMb5EVFOUIjKlEPCw0517qAZiP:VW41v9uMt5RKSPy17qws
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13893

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

RemoveDirectoryW lstrcmpiA GetTempFileNameW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW WriteFile ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize CreateFileW GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject CopyFileW

⌚/38.exe

IMPHASH f6baa5eaa8231d4fe8e922a2e6d240ea
SHA256 477712f48e356d8c77224a1264dd765b1420fc8c0c318b295744a68316b3f055
MD5 40ecc726bee273961d09301c0316af6e
SHA1 0a1122398641375babcf28a7feb24d1935011a7f
SHA512 130911be930bd0911735de6eeae637843ab7c68b48a8213aa9b4dabee9cbfcacdb5d1eb927e14c5bec133bedf6a3c30d0a105d1c2e41aeea3338b9f431ef807d
SSDEEP 98304:ZR5VLB+g2pSMqgZmqK0scjW0nOs992v6QeoLqELeUpDGxK9jwwLPk4S7cdz5:ZRzLBt2jXkwj3lz2vAouELeU1Gogb
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

e4:40:cd:11:d2:ab:4a:0c:f7:29:22:ff:28:51:05:71:e6:b6:4c:07:3d:a5:fa:f5:6c:7b:9e:f3:b3:8a:8e:ce

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=MAGIX Inc,O=MAGIX Inc,L=MAGIX Inc,C=ENG,1.2.840.113549.1.9.1=#13094d4147495820496e63

Chains

Feb 11, 2024

PE Signature issue

Digest

09:22:f3:d2:bb:df:a8:2d:cf:46:83:a9:a3:a1:d5:9a:bb:cc:67:7d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=MAGIX Inc,O=MAGIX Inc,L=MAGIX Inc,C=ENG,1.2.840.113549.1.9.1=#13094d4147495820496e63

Chains

Mar 11, 2024

Subject

CN=MAGIX Inc,O=MAGIX Inc,L=MAGIX Inc,C=ENG,1.2.840.113549.1.9.1=#13094d4147495820496e63

Serial Number

4b:f0:21:9f:9c:7b:1c:08

Issuer

CN=MAGIX Inc,O=MAGIX Inc,L=MAGIX Inc,C=ENG,1.2.840.113549.1.9.1=#13094d4147495820496e63

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 23, 2024 - Jan 23, 2026

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 3, 2023 - Aug 2, 2034

Subject

CN=MAGIX Inc,O=MAGIX Inc,L=MAGIX Inc,C=ENG,1.2.840.113549.1.9.1=#13094d4147495820496e63

Serial Number

4b:f0:21:9f:9c:7b:1c:08

Issuer

CN=MAGIX Inc,O=MAGIX Inc,L=MAGIX Inc,C=ENG,1.2.840.113549.1.9.1=#13094d4147495820496e63

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 23, 2024 - Jan 23, 2026

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 3, 2023 - Aug 2, 2034

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

103519

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

comctl32

ord17

shell32

SHGetSpecialFolderPathW ShellExecuteW SHGetMalloc SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteExW

gdi32

CreateCompatibleDC CreateFontIndirectW DeleteObject DeleteDC GetCurrentObject StretchBlt GetDeviceCaps CreateCompatibleBitmap SelectObject SetStretchBltMode GetObjectW

advapi32

FreeSid AllocateAndInitializeSid CheckTokenMembership

user32

GetWindowLongW GetMenu SetWindowPos GetWindowDC ReleaseDC GetDlgItem GetParent GetWindowRect GetClassNameA CreateWindowExW SetTimer GetMessageW DispatchMessageW KillTimer DestroyWindow SendMessageW EndDialog wsprintfW GetWindowTextW GetWindowTextLengthW GetSysColor wsprintfA SetWindowTextW MessageBoxA ScreenToClient GetClientRect SetWindowLongW UnhookWindowsHookEx SetFocus GetSystemMetrics SystemParametersInfoW ShowWindow DrawTextW GetDC ClientToScreen GetWindow DialogBoxIndirectParamW DrawIconEx CallWindowProcW DefWindowProcW CallNextHookEx PtInRect SetWindowsHookExW LoadImageW LoadIconW MessageBeep EnableWindow IsWindow EnableMenuItem GetSystemMenu CreateWindowExA wvsprintfW CharUpperW GetKeyState CopyImage

ole32

CreateStreamOnHGlobal CoCreateInstance CoInitialize

oleaut32

VariantClear SysFreeString OleLoadPicture SysAllocString

kernel32

GetFileSize SetFilePointer ReadFile WaitForMultipleObjects GetModuleHandleA SetFileTime SetEndOfFile LeaveCriticalSection EnterCriticalSection DeleteCriticalSection FormatMessageW lstrcpyW LocalFree IsBadReadPtr GetSystemDirectoryW GetCurrentThreadId SuspendThread TerminateThread InitializeCriticalSection ResetEvent SetEvent CreateEventW GetVersionExW GetModuleFileNameW GetCurrentProcess SetProcessWorkingSetSize SetCurrentDirectoryW GetDriveTypeW CreateFileW GetCommandLineW GetStartupInfoW CreateProcessW CreateJobObjectW ResumeThread AssignProcessToJobObject CreateIoCompletionPort SetInformationJobObject GetQueuedCompletionStatus GetExitCodeProcess CloseHandle SetEnvironmentVariableW GetTempPathW GetSystemTimeAsFileTime lstrlenW CompareFileTime SetThreadLocale FindFirstFileW DeleteFileW FindNextFileW FindClose RemoveDirectoryW ExpandEnvironmentStringsW WideCharToMultiByte VirtualAlloc GlobalMemoryStatusEx lstrcmpW GetEnvironmentVariableW lstrcmpiW lstrlenA GetLocaleInfoW MultiByteToWideChar GetUserDefaultUILanguage GetSystemDefaultUILanguage GetSystemDefaultLCID lstrcmpiA GlobalAlloc GlobalFree MulDiv FindResourceExA SizeofResource LoadResource LockResource LoadLibraryA GetProcAddress GetModuleHandleW ExitProcess lstrcatW GetDiskFreeSpaceExW SetFileAttributesW SetLastError Sleep GetExitCodeThread WaitForSingleObject CreateThread GetLastError SystemTimeToFileTime GetLocalTime GetFileAttributesW CreateDirectoryW WriteFile GetStdHandle VirtualFree GetStartupInfoA

msvcrt

??3@YAXPAX@Z ??2@YAPAXI@Z memcmp free memcpy _wtol _controlfp _except_handler3 __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln exit _XcptFilter _exit ??1type_info@@UAE@XZ _onexit __dllonexit _CxxThrowException _beginthreadex _EH_prolog ?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z memset _wcsnicmp strncmp wcsncmp malloc memmove _purecall

⌚/crypt.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 49e3c6738e6d99770ac69d75adde05379910f67bd988c378a7ab53e146510de4
MD5 084787a02d925fecd0821303aab375ad
SHA1 d620d2d42a3ee9bb40672d25f93b23fb6f3bbd51
SHA512 d6e05094e6c1f407996ed3dcdf82ad1dceddb3f9768d59c9b86d573aeb13af7f13d65d806ff6e925197e9ff8f7ff50efaf32da45fcd514df83aec25043f7de68
SSDEEP 12288:99pVcO+InqVT9zfIyAasfsm5p58TViC18j/i3DsD:XncO+bJgD3+pR8riT0
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

43726

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

⌚/sfasfafs.exe

SHA256 5b1cfa7129a5d5d030d207774022ea3a7d50375c4a6a3291621a71641dda45c2
MD5 27f4c8db69b471adac1d5ccfd0ff68d5
SHA1 4e66a5f0cf3019e4c095827429fe93c8b4833550
SHA512 b261ebf44443e6811bbd1ef4aa5cb5110676fffd2dcfe12cb709be65dfe29d1a285ce524b05c73a2aa51fdcca97b5e2fdaaa5e7e74313d7eb750f352a89d42fb
SSDEEP 98304:UDNQJNkbEQ2vVSecOVRS7jAXIt2zvyeT5CrhS7CSGE:URrecoRS7lt2zFT4l+CS7
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1779458

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

34d9359a2a6b15423c74298520282b9b.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

⌚/38.exe

PE Signature issue

PE Signature issue

comctl32

shell32

gdi32

advapi32

user32

ole32

oleaut32

kernel32

msvcrt

generic

⌚/crypt.exe

mscoree

dotnet

⌚/sfasfafs.exe

generic