daf8a94cc8811594d149bbcdc88bd6ce98f9013acecb73f80d657ee09c1dcbfb

Sharing

Copy URL Twitter E-mail

General

Target
daf8a94cc8811594d149bbcdc88bd6ce98f9013acecb73f80d657ee09c1dcbfb
Size 5.3MB
Sample240423-e7mzvsdb4t
SHA256 daf8a94cc8811594d149bbcdc88bd6ce98f9013acecb73f80d657ee09c1dcbfb
MD5 a8a8ea95db74025ba45984e0aae0c771
SHA1 817a4673775bba6bd3644b5c459c6b409f7671eb
SHA512 ae0a71efaa2dcddb2912bf177a63e41ebd7f1f9cf5a4989b35c58b5558d3da78ab9379bfcb5fd2fc07a27fc47f6fae19654ba2ca716c53772e5ccf7bf273eea2
SSDEEP 98304:2jZ3DHpk8y6+wtMayoFYdfewSBykF7CzuAzJrjH1bTen42c:2N3DHpTyBwtMa7F2cBTF7ehljVbTeY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

themida

Malware Config

Signatures

Detects executables packed with Themida 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Themida

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

File Explorer

daf8a94cc8811594d149bbcdc88bd6ce98f9013acecb73f80d657ee09c1dcbfb

.exe 5.3MB

daf8a94cc8811594d149bbcdc88bd6ce98f9013acecb73f80d657ee09c1dcbfb

SHA256 daf8a94cc8811594d149bbcdc88bd6ce98f9013acecb73f80d657ee09c1dcbfb
MD5 a8a8ea95db74025ba45984e0aae0c771
SHA1 817a4673775bba6bd3644b5c459c6b409f7671eb
SHA512 ae0a71efaa2dcddb2912bf177a63e41ebd7f1f9cf5a4989b35c58b5558d3da78ab9379bfcb5fd2fc07a27fc47f6fae19654ba2ca716c53772e5ccf7bf273eea2
SSDEEP 98304:2jZ3DHpk8y6+wtMayoFYdfewSBykF7CzuAzJrjH1bTen42c:2N3DHpTyBwtMa7F2cBTF7ehljVbTeY
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detects executables packed with Themida
Themida packer

Detects Themida, an advanced Windows software protection system.

themida

PE Signature issue

Digest

5f:fd:13:e9:be:e6:66:21:0d:9b:f2:f9:39:11:6d:42:99:71:3c:80

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Clean WeChat X Pro,O=WQW,1.2.840.113549.1.9.1=#0c103731343137343332334071712e636f6d

Chains

Apr 20, 2024

Minor OS version

Major OS version

Entry point

10621016

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

Size

1.1MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

836KB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

56KB

Virtual Size

436KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

36KB

Virtual Size

394KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

368KB

Virtual Size

368KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

Virtual Size

4.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

daf8a94cc8811594d149bbcdc88bd6ce98f9013acecb73f80d657ee09c1dcbfb

PE Signature issue

generic