SecuriteInfo[.]com[.]Win64[.]MalwareX-gen[.]47427539[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
SecuriteInfo.com.Win64.MalwareX-gen.47427539.exe
Size 3.0MB
Sample251116-rlt79syncq
SHA256 238693578a24dab8184c5ee795cd5369ebc7956adb0eaa6e1a1de7f006d5514b
MD5 6536f096a328ae37d5de00a68ac0f3d3
SHA1 c29fab0eba3a1f69492f56c6c7cd568b2f84c243
SHA512 4cb480b17ebd555896bce7d2113b3ea51df9e3a323997fa6a318e197153d2e0702c8c2b03c3767d6d88d8f952204f74dc6cde68ad624fd58cff1f37750895d32
SSDEEP 98304:TCSV0/sgCjrX27msBc0yu+TowG0NJeIo:ebkgECTuna2JD
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
SecuriteInfo.com.Win64.MalwareX-gen.47427539.exe

File Explorer

SecuriteInfo.com.Win64.MalwareX-gen.47427539.exe

.exe 3.0MB

SecuriteInfo.com.Win64.MalwareX-gen.47427539.exe

SHA256 238693578a24dab8184c5ee795cd5369ebc7956adb0eaa6e1a1de7f006d5514b
MD5 6536f096a328ae37d5de00a68ac0f3d3
SHA1 c29fab0eba3a1f69492f56c6c7cd568b2f84c243
SHA512 4cb480b17ebd555896bce7d2113b3ea51df9e3a323997fa6a318e197153d2e0702c8c2b03c3767d6d88d8f952204f74dc6cde68ad624fd58cff1f37750895d32
SSDEEP 98304:TCSV0/sgCjrX27msBc0yu+TowG0NJeIo:ebkgECTuna2JD
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

52:f8:29:a9:7b:e3:ef:85:b2:95:62:45:57:17:d1:e7:fb:e8:3f:ff:ba:21:99:0b:a5:5f:90:00:05:10:6d:cf

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=81967985,CN=Surfshark B.V.,O=Surfshark B.V.,STREET=Kabelweg 57,L=Amsterdam,ST=Noord-Holland,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Nov 6, 2025

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

76:53:fe:ac:75:46:48:93:f5:e5:d7:4a:48:3a:4e:f8

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2020 - Mar 18, 2045

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

SERIALNUMBER=81967985,CN=Surfshark B.V.,O=Surfshark B.V.,STREET=Kabelweg 57,L=Amsterdam,ST=Noord-Holland,C=NL,1.3.6.1.4.1.311.60.2.1.3=#13024e4c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

59:5b:bf:7a:50:9d:f5:b8:b3:6f:cf:2d

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 2, 2025 - Apr 2, 2028

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:03:32:e1:65:bf:9b:78:43:e0:99:75:94:63:77:0b

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 11, 2025 - Dec 10, 2034

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

5615704

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

Size

207KB

Virtual Size

444KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

40KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

77KB

Virtual Size

247KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

9KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

2KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

250KB

Virtual Size

249KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.themida

Size

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

16B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

SecuriteInfo.com.Win64.MalwareX-gen.47427539.exe

PE Signature issue

generic