1e09042c08333f8e61d7c2c13c79360467a7e818fbb775a17eb38b7c39621316

Sharing

Copy URL Twitter E-mail

General

Target
1e09042c08333f8e61d7c2c13c79360467a7e818fbb775a17eb38b7c39621316
Size 3.2MB
Sample260305-c8k6jsa19v
SHA256 1e09042c08333f8e61d7c2c13c79360467a7e818fbb775a17eb38b7c39621316
MD5 20b6903479682a018b582b20c40dc5ec
SHA1 be65f9629afd6bc45564b9e05f5654f98ae9793d
SHA512 d860ecce6de3c98d827b506f38fb2b93db4f79b19225e6e40f62f17414530afb745cc6baad0496a474002897df3626afe8b23d7cb606c9f835d50eff2e143910
SSDEEP 49152:U3yi/1tDQN5YnO/woBLt+0St56WmSSP3hacauXDABdHaoazk9gt4NVS1S10+TukX:MJfsN5ZBLwtQ9Rwu4dHa9krVS1J+TukX
TLSH
T14FF50124692FD7C7D481AAB86449039C4E805F29E8A1654FFE7E7E1E76BD1C02C173A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
1e09042c08333f8e61d7c2c13c79360467a7e818fbb775a17eb38b7c39621316

File Explorer

1e09042c08333f8e61d7c2c13c79360467a7e818fbb775a17eb38b7c39621316

.exe 3.2MB

1e09042c08333f8e61d7c2c13c79360467a7e818fbb775a17eb38b7c39621316

SHA256 1e09042c08333f8e61d7c2c13c79360467a7e818fbb775a17eb38b7c39621316
MD5 20b6903479682a018b582b20c40dc5ec
SHA1 be65f9629afd6bc45564b9e05f5654f98ae9793d
SHA512 d860ecce6de3c98d827b506f38fb2b93db4f79b19225e6e40f62f17414530afb745cc6baad0496a474002897df3626afe8b23d7cb606c9f835d50eff2e143910
SSDEEP 49152:U3yi/1tDQN5YnO/woBLt+0St56WmSSP3hacauXDABdHaoazk9gt4NVS1S10+TukX:MJfsN5ZBLwtQ9Rwu4dHa9krVS1J+TukX
TLSH
T14FF50124692FD7C7D481AAB86449039C4E805F29E8A1654FFE7E7E1E76BD1C02C173A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

24:9e:ec:99:f9:90:87:01:5a:0b:7e:c9:20:47:43:dc:cb:fa:a1:27:b7:6d:3f:e0:7c:78:2a:df:eb:91:ea:1b

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Martin Tofall,O=Martin Tofall,ST=Nordrhein-Westfalen,C=DE

Chains

Aug 5, 2025

CN=Martin Tofall,O=Martin Tofall,ST=Nordrhein-Westfalen,C=DE

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Martin Tofall,O=Martin Tofall,ST=Nordrhein-Westfalen,C=DE

Serial Number

5a:34:a5:b6:36:56:3d:f6:b7:a1:f0:7f:b5:f2:39:79

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 8, 2022 - Jan 9, 2026

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

6148184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

Size

207KB

Virtual Size

444KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

40KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

77KB

Virtual Size

247KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

9KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

2KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

169KB

Virtual Size

168KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.themida

Size

Virtual Size

4.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

16B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

1e09042c08333f8e61d7c2c13c79360467a7e818fbb775a17eb38b7c39621316

PE Signature issue

generic