51c35cc8bfc37189048a0454992f30143289dcace11c5fc108db47e91f467bd0

Sharing

Copy URL

Twitter E-mail

General

Target

51c35cc8bfc37189048a0454992f30143289dcace11c5fc108db47e91f467bd0
Size

3.3MB
MD5

7cfe878555b8cc04fc52385219b423d7
SHA1

cff23beb3f3223610a37a9b52d3b9495438c5c1f
SHA256

51c35cc8bfc37189048a0454992f30143289dcace11c5fc108db47e91f467bd0
SHA512

31ad38c09589a8ba91d0c2b4b3f12cda02909fd4cdd06a84b415c2018983c0dfd8b675c39089a0313e1a0c6c95ef023d9d4f66fcd05d2b4aeb313d75efe86386
SSDEEP

49152:pd0WyZt1UbFSOHUM04jhsaDfZt6TJ5nD3hdkMgE+jCtWszgEBCs9IYFDl:aZt8FjUF4jhBZtmhjjf8gRPJ

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Files

51c35cc8bfc37189048a0454992f30143289dcace11c5fc108db47e91f467bd0
.exe windows:6 windows x86 arch:x86

Code Sign

51:1b:ab:c2:e5:a2:62:8a:42:f1:1a:c0:1c:51:74:82
Certificate

Issuer

CN=ViewSony game mode plus

Not Before

23-10-2024 13:53

Not After

24-10-2034 13:53

Subject

CN=ViewSony game mode plus

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89
Certificate

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Not Before

15-01-2024 00:00

Not After

14-04-2035 23:59

Subject

CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Certificate

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Not Before

22-03-2021 00:00

Not After

21-03-2036 23:59

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

22-03-2021 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c4:02:cc:5b:91:ad:08:a9:bd:8b:20:4f:8b:6e:24:ba:4b:ec:dc:e6:7d:59:d4:a6:c5:3c:7d:cd:a0:36:b3:d9
Signer

Actual PE Digest

c4:02:cc:5b:91:ad:08:a9:bd:8b:20:4f:8b:6e:24:ba:4b:ec:dc:e6:7d:59:d4:a6:c5:3c:7d:cd:a0:36:b3:d9

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 156KB - Virtual size: 314KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 26KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 2KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 176KB - Virtual size: 175KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 15KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.themida
Size: - Virtual size: 5.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 16B - Virtual size: 4KB

IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

51:1b:ab:c2:e5:a2:62:8a:42:f1:1a:c0:1c:51:74:82Certificate

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89Certificate

Extended Key Usages

Key Usages

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3fCertificate

Extended Key Usages

Key Usages

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68Certificate

Extended Key Usages

Key Usages

c4:02:cc:5b:91:ad:08:a9:bd:8b:20:4f:8b:6e:24:ba:4b:ec:dc:e6:7d:59:d4:a6:c5:3c:7d:cd:a0:36:b3:d9Signer

Headers

DLL Characteristics

File Characteristics

Sections

Size: 156KB - Virtual size: 314KB

Size: 26KB - Virtual size: 68KB

Size: 2KB - Virtual size: 25KB

.rsrc Size: 176KB - Virtual size: 175KB

Size: 15KB - Virtual size: 19KB

.idata Size: 512B - Virtual size: 4KB

.tls Size: 512B - Virtual size: 4KB

.themida Size: - Virtual size: 5.1MB

.boot Size: 2.9MB - Virtual size: 2.9MB

.reloc Size: 16B - Virtual size: 4KB

51:1b:ab:c2:e5:a2:62:8a:42:f1:1a:c0:1c:51:74:82
Certificate

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89
Certificate

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Certificate

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Certificate

c4:02:cc:5b:91:ad:08:a9:bd:8b:20:4f:8b:6e:24:ba:4b:ec:dc:e6:7d:59:d4:a6:c5:3c:7d:cd:a0:36:b3:d9
Signer

.rsrc
Size: 176KB - Virtual size: 175KB

.idata
Size: 512B - Virtual size: 4KB

.tls
Size: 512B - Virtual size: 4KB

.themida
Size: - Virtual size: 5.1MB

.boot
Size: 2.9MB - Virtual size: 2.9MB

.reloc
Size: 16B - Virtual size: 4KB