9b4a2d9750aaa1b533ff618300d60d2f[.]bin

General

Target
9b4a2d9750aaa1b533ff618300d60d2f.bin
Size 5.5MB
Sample240623-dfct5sxcnc
SHA256 f40b371a32eded9a70d448e29333fd349177d3303159c7d8337eb645d20b7a9a
MD5 7db854cf78a9c3ae2341210edf0a787b
SHA1 7d27e8fbb78b68580e0779e4504ebf88839e1f26
SHA512 d7c9f5db560b87003e8d8fc829e4f97b32f74dffb563d2c3e8a8c910b01334ba2d00090a1f6ad2c984f51ee4f83857562d70594e083e6075bf71f2c45381f3e4
SSDEEP 98304:M7ToESi7y3ljFU1zLtwa5cuEozQUe5tGSRgDURu4JN3rLAGF13VP6aqoCx92tqvJ:uTQi7otivwa5c1oEUefhRcURnbgGFlY3
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
static1/unpack001/d445ced88bc3e2de34ad6a0636230202ce50a8e22098fc9b9e8fa78f0873f0bd.exe	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/d445ced88bc3e2de34ad6a0636230202ce50a8e22098fc9b9e8fa78f0873f0bd.exe

File Explorer

9b4a2d9750aaa1b533ff618300d60d2f.bin

.zip 5.5MB
d445ced88bc3e2de34ad6a0636230202ce50a8e22098fc9b9e8fa78f0873f0bd.exe

.exe 5.5MB

9b4a2d9750aaa1b533ff618300d60d2f.bin

SHA256 f40b371a32eded9a70d448e29333fd349177d3303159c7d8337eb645d20b7a9a
MD5 7db854cf78a9c3ae2341210edf0a787b
SHA1 7d27e8fbb78b68580e0779e4504ebf88839e1f26
SHA512 d7c9f5db560b87003e8d8fc829e4f97b32f74dffb563d2c3e8a8c910b01334ba2d00090a1f6ad2c984f51ee4f83857562d70594e083e6075bf71f2c45381f3e4
SSDEEP 98304:M7ToESi7y3ljFU1zLtwa5cuEozQUe5tGSRgDURu4JN3rLAGF13VP6aqoCx92tqvJ:uTQi7otivwa5c1oEUefhRcURnbgGFlY3
MD5 SHA1 SHA512 SSDEEP

Password

infected

d445ced88bc3e2de34ad6a0636230202ce50a8e22098fc9b9e8fa78f0873f0bd.exe

SHA256 d445ced88bc3e2de34ad6a0636230202ce50a8e22098fc9b9e8fa78f0873f0bd
MD5 9b4a2d9750aaa1b533ff618300d60d2f
SHA1 a205bceff0efe3141810a14fbf4b850355165b92
SHA512 665952e14d1f15d334282aefa7c4b4562bb27d5cb43a86f31c03bb9bbc27d470562aff1d1f7ff800fd6e7cde7e5a160ef9b0da95e69ca62d0909a43a013b9d0e
SSDEEP 98304://vsROSfBa8P9LuKpjO/bmZ4CPVdErgPgPvO63wGxVoz7XJfNCZsD5CR4+xbj://vsX3V1p6bmyCPLCeCwGxILJfNCZsD6
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

4

Entry point

9732184

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

PDB paths

Name

Size

30KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

1KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.idata

Size

512B

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

Virtual Size

9.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

5.5MB

Virtual Size

5.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

9b4a2d9750aaa1b533ff618300d60d2f.bin

d445ced88bc3e2de34ad6a0636230202ce50a8e22098fc9b9e8fa78f0873f0bd.exe

generic