malware1.exe
- SHA256 14a2182fdf7ea02fcb38f9d6d2ee629910566f2016869f6446570e3bd44a8a34
-
Themida packer
Detects Themida, an advanced Windows software protection system.
PE Signature issue
Digest
3b:35:8a:e3:bc:a8:f6:fe:01:df:1e:fe:ef:73:68:54:f4:ed:0d:8a:21:c3:0e:99:27:88:e5:05:49:02:fb:13
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Avira,O=Avira LTD,C=US,1.2.840.113549.1.9.1=#0c0f61627573654061766972612e636f6d
Chains
Apr 30, 2024
PE Signature issue
Digest
45:0a:97:01:1b:f0:cf:71:5b:de:5b:20:ee:0b:59:ff:bc:69:d7:a5
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Avira,O=Avira LTD,C=US,1.2.840.113549.1.9.1=#0c0f61627573654061766972612e636f6d
Chains
May 23, 2024
Subject
CN=Avira,O=Avira LTD,C=US,1.2.840.113549.1.9.1=#0c0f61627573654061766972612e636f6d
Serial Number
70:61:bd:33:ff:35:ab:e4
Issuer
CN=Avira,O=Avira LTD,C=US,1.2.840.113549.1.9.1=#0c0f61627573654061766972612e636f6d
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 30, 2024 - Apr 30, 2026
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Subject
CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 3, 2023 - Aug 2, 2034
Subject
CN=Avira,O=Avira LTD,C=US,1.2.840.113549.1.9.1=#0c0f61627573654061766972612e636f6d
Serial Number
70:61:bd:33:ff:35:ab:e4
Issuer
CN=Avira,O=Avira LTD,C=US,1.2.840.113549.1.9.1=#0c0f61627573654061766972612e636f6d
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 30, 2024 - Apr 30, 2026
Subject
CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 3, 2023 - Aug 2, 2034
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Minor OS version
0
Major OS version
4
Entry point
9446506
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
Size
17KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
1024B
Virtual Size
126KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.themida
Size
16.0MB
Virtual Size
16.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=163, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,