6268d96655dea25baf0cffb087511353a856d12e74017215a0378000e24dbcdd

Sharing

Copy URL Twitter E-mail

General

Target

6268d96655dea25baf0cffb087511353a856d12e74017215a0378000e24dbcdd
Size

8.6MB
MD5

a4ceaf8b3ac9127ce9d01b7f55adc3e5
SHA1

ab95f22c3c465c05d71bb746d37a8e828f99270c
SHA256

6268d96655dea25baf0cffb087511353a856d12e74017215a0378000e24dbcdd
SHA512

5479903bba90f1f689756d4a76f1243a22aadee708a7efdb5fadc7e700077ccbbb8e61f6950e936407185f7d51b7f4c6c045f205c83becab985b8763827c5bd5
SSDEEP

196608:Kdmtuq11h3bp/t3cM5wRHV5mgHrdEax+Wt:r51h3bh2MoHV5mMdEaxJ

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Files

6268d96655dea25baf0cffb087511353a856d12e74017215a0378000e24dbcdd
.exe windows:4 windows x86 arch:x86

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

28:ad:70:98:b1:5e:32:62:6b:39:c4:91
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

24/04/2024, 02:29

Not After

28/05/2027, 08:06

Subject

SERIALNUMBER=120111-0607278,CN=Carelabs Co.\,Ltd,O=Carelabs Co.\,Ltd,STREET=16 Yeoksam-ro 2-gil,L=Gangnam-gu,ST=Seoul,C=KR,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

07/11/2023, 17:13

Not After

09/12/2034, 17:13

Subject

CN=Globalsign TSA for CodeSign1 - R6 - 202311,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10/12/2014, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

cc:80:44:06:0b:69:27:de:e9:3a:90:e3:19:04:6b:17:49:29:6f:69:63:2d:63:45:26:0d:ea:8c:3c:d3:d9:91
Signer

Actual PE Digest

cc:80:44:06:0b:69:27:de:e9:3a:90:e3:19:04:6b:17:49:29:6f:69:63:2d:63:45:26:0d:ea:8c:3c:d3:d9:91

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 6.0MB - Virtual size: 36.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 4KB - Virtual size: 387KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 8KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 4.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

28:ad:70:98:b1:5e:32:62:6b:39:c4:91Certificate

Extended Key Usages

Key Usages

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16Certificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51Certificate

Key Usages

cc:80:44:06:0b:69:27:de:e9:3a:90:e3:19:04:6b:17:49:29:6f:69:63:2d:63:45:26:0d:ea:8c:3c:d3:d9:91Signer

Headers

File Characteristics

Sections

Size: 6.0MB - Virtual size: 36.4MB

Size: 4KB - Virtual size: 387KB

Size: 8KB - Virtual size: 23KB

.idata Size: 4KB - Virtual size: 4KB

.rsrc Size: 32KB - Virtual size: 32KB

.themida Size: - Virtual size: 4.1MB

.boot Size: 2.5MB - Virtual size: 2.5MB

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

28:ad:70:98:b1:5e:32:62:6b:39:c4:91
Certificate

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

cc:80:44:06:0b:69:27:de:e9:3a:90:e3:19:04:6b:17:49:29:6f:69:63:2d:63:45:26:0d:ea:8c:3c:d3:d9:91
Signer

.idata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 32KB - Virtual size: 32KB

.themida
Size: - Virtual size: 4.1MB

.boot
Size: 2.5MB - Virtual size: 2.5MB