e09b3349afedd9bc6713f0640dac5a73

Sharing

Copy URL

Twitter E-mail

General

Target

e09b3349afedd9bc6713f0640dac5a73
Size

3.7MB
MD5

e09b3349afedd9bc6713f0640dac5a73
SHA1

2bed69865fce75b42da5f53b02d74eaba01f7819
SHA256

f8cad8601b4d97cbe6befe13fce900eaa01063283a91ffae28038c9370f7b582
SHA512

48ed49531d29f503f1c8f25ab278de851560576aca96baa521b0c1b1b6b2887ba6c6d71cbed0049faaeb1c4c8b531b186f7eba5cd141ae1ececafc3aa280a213
SSDEEP

98304:VG0WE8JkdS9cHaXMsbNWhYq3bdckunUnU63:fvNIc6XyYq3bHtX

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
sample	themida

Files

e09b3349afedd9bc6713f0640dac5a73
.exe windows:4 windows x86 arch:x86

Code Sign

0c:15:be:4a:15:bb:09:03:c9:01:b1:d6:c2:65:30:2f
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-11-2018 00:00

Not After

17-11-2021 12:00

Subject

CN=Google LLC,O=Google LLC,L=Mountain View,ST=ca,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2013 12:00

Not After

22-10-2028 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-10-2019 00:00

Not After

17-10-2030 00:00

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

42:e6:b1:8c:97:29:c9:74:69:1a:5a:d1:aa:0a:7b:2b:ca:65:81:90:67:17:c3:1b:8d:90:86:c1:ed:7d:cf:b7
Signer

Actual PE Digest

42:e6:b1:8c:97:29:c9:74:69:1a:5a:d1:aa:0a:7b:2b:ca:65:81:90:67:17:c3:1b:8d:90:86:c1:ed:7d:cf:b7

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Size: 434KB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 78KB - Virtual size: 190KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 15B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.imports
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 190KB - Virtual size: 190KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 5.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

0c:15:be:4a:15:bb:09:03:c9:01:b1:d6:c2:65:30:2fCertificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6dCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

42:e6:b1:8c:97:29:c9:74:69:1a:5a:d1:aa:0a:7b:2b:ca:65:81:90:67:17:c3:1b:8d:90:86:c1:ed:7d:cf:b7Signer

Headers

DLL Characteristics

File Characteristics

Sections

Size: 434KB - Virtual size: 1.2MB

Size: 78KB - Virtual size: 190KB

Size: 15B - Virtual size: 12B

.imports Size: 512B - Virtual size: 8KB

.rsrc Size: 190KB - Virtual size: 190KB

.themida Size: - Virtual size: 5.1MB

.boot Size: 3.0MB - Virtual size: 3.0MB

0c:15:be:4a:15:bb:09:03:c9:01:b1:d6:c2:65:30:2f
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

42:e6:b1:8c:97:29:c9:74:69:1a:5a:d1:aa:0a:7b:2b:ca:65:81:90:67:17:c3:1b:8d:90:86:c1:ed:7d:cf:b7
Signer

.imports
Size: 512B - Virtual size: 8KB

.rsrc
Size: 190KB - Virtual size: 190KB

.themida
Size: - Virtual size: 5.1MB

.boot
Size: 3.0MB - Virtual size: 3.0MB