UniversalInstaller[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
UniversalInstaller.exe
Size 4.4MB
Sample240410-y41lbsae69
SHA256 ead2353e072d371576f604c0f2b25e39262daf28564411932a0091a9415560eb
MD5 b26b21b1c866d78aac7f9df53043593d
SHA1 06e9d88b103c0d69bf4d65eb1fbcd7a4447c6157
SHA512 a087da4f05d43d7fbaae2f2f6e9ff68d4cc0eaed30ea78cae9b0e8bc401617bc0b9ec96671704318cffc44ea2320da885451a562ff2d3e0ae1d4f6e26e580464
SSDEEP 98304:HwsgN1jvDVYGvQvBn0S3fwPZ4uffJYsLa+U9Y:Qs+vxYGvQp0SPwPFJYsLa/9Y
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

File Explorer

UniversalInstaller.exe

.exe 4.4MB

UniversalInstaller.exe

SHA256 ead2353e072d371576f604c0f2b25e39262daf28564411932a0091a9415560eb
MD5 b26b21b1c866d78aac7f9df53043593d
SHA1 06e9d88b103c0d69bf4d65eb1fbcd7a4447c6157
SHA512 a087da4f05d43d7fbaae2f2f6e9ff68d4cc0eaed30ea78cae9b0e8bc401617bc0b9ec96671704318cffc44ea2320da885451a562ff2d3e0ae1d4f6e26e580464
SSDEEP 98304:HwsgN1jvDVYGvQvBn0S3fwPZ4uffJYsLa+U9Y:Qs+vxYGvQp0SPwPFJYsLa/9Y
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Themida packer

Detects Themida, an advanced Windows software protection system.

themida

Digest

80:7a:f0:47:0f:25:86:1e:37:e3:2b:ab:89:6b:3d:de:fc:32:76:66:3b:27:84:ec:04:7c:74:6f:11:4f:06:54

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=14540363,CN=Absolute Mods Ltd,O=Absolute Mods Ltd,ST=West Midlands,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Feb 28, 2024

SERIALNUMBER=14540363,CN=Absolute Mods Ltd,O=Absolute Mods Ltd,ST=West Midlands,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Serial Number

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

SERIALNUMBER=14540363,CN=Absolute Mods Ltd,O=Absolute Mods Ltd,ST=West Midlands,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

19:4d:c8:67:0e:2b:fe:ce:42:47:9e:48:6c:46:84:5f

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 24, 2024 - Jan 23, 2027

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 3, 2023 - Aug 2, 2034

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

8409176

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

Size

101KB

Virtual Size

211KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

262KB

Virtual Size

540KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

1024B

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

2KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

11KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.idata

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

Virtual Size

7.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

4.0MB

Virtual Size

4.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

16B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ

generic

count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=12, id=260, version=31823,

count=5, id=259, version=31823,

count=33, id=261, version=31823,

count=4, id=257, version=31823,

count=1, id=262, version=29395,

count=1, id=261, productName=VS2019 v16.6.2 build 28806, version=28806,

count=8, id=257, productName=VS2019 v16.6.2 build 28806, version=28806,

count=7, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,

count=2, id=259, productName=VS2019 v16.9.2 build 29913, version=29913,

count=70, id=264, version=31933,

count=2, id=257, version=27034,

count=13, id=257, version=29395,

count=734, id=1, productName=Unmarked objects,

count=7, id=261, version=31933,

count=1, id=255, version=31933,

count=1, id=151,

count=1, id=258, version=31933,