fcc22a367ed0a8d8de94f5159ab12c32606f97326b832eb47327b7707ba457a6[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
fcc22a367ed0a8d8de94f5159ab12c32606f97326b832eb47327b7707ba457a6.exe
Size 3.8MB
Sample260703-dn8xjsfx3k
SHA256 fcc22a367ed0a8d8de94f5159ab12c32606f97326b832eb47327b7707ba457a6
MD5 193692e1cf957eef7e6cf2f6bc74be86
SHA1 9d1f849b57c96ca71f0f90c73de97fa912b691d7
SHA512 d0bcad2b98e5efc9c767f9a6ad87a6d62638131753bff22b21b883d90c23be17b65594b6d8c4510b255f28806b2a1dc2a01fc0e2138c3146d6e64abcd4a37697
SSDEEP 98304:agjjIlB/cHzyG0hlcX8fjr3oS6QLErN4QkMvqs:agwUTyGR8rqa7QkMis
TLSH
T1240622467E8B0AF1C01DCB74D84220AC7127B781DDA24E273AC911189EEB6656F7E3DD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
fcc22a367ed0a8d8de94f5159ab12c32606f97326b832eb47327b7707ba457a6.exe

File Explorer

fcc22a367ed0a8d8de94f5159ab12c32606f97326b832eb47327b7707ba457a6.exe

.exe 3.8MB

fcc22a367ed0a8d8de94f5159ab12c32606f97326b832eb47327b7707ba457a6.exe

IMPHASH 023aae353653db016d3a89da454d1d86
SHA256 fcc22a367ed0a8d8de94f5159ab12c32606f97326b832eb47327b7707ba457a6
MD5 193692e1cf957eef7e6cf2f6bc74be86
SHA1 9d1f849b57c96ca71f0f90c73de97fa912b691d7
SHA512 d0bcad2b98e5efc9c767f9a6ad87a6d62638131753bff22b21b883d90c23be17b65594b6d8c4510b255f28806b2a1dc2a01fc0e2138c3146d6e64abcd4a37697
SSDEEP 98304:agjjIlB/cHzyG0hlcX8fjr3oS6QLErN4QkMvqs:agwUTyGR8rqa7QkMis
TLSH
T1240622467E8B0AF1C01DCB74D84220AC7127B781DDA24E273AC911189EEB6656F7E3DD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

77:87:af:98:1d:17:5e:53:cd:39:92:d5:82:73:f4:7f:c1:6b:e9:4f:81:2e:7f:8d:ee:62:10:ed:5c:8c:cf:90

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=œáz±åz±åz±æz±åz±åz±åzœáz±åz±åz±æz±åz±åz±åzœáz±åz±åz±æz±åz±åz±åzœáz±åz±åz±æz±åz±åz±åzœáz±åz±åz±æz±åz±åz±åzœáz±åz±åz±æz±åz±åz±åzœáz±åz±åz±æz±åz±åz±åzœáz±åz±åz±æz±åz±åz±åzœáz±åz±åz±æz±åz±åz±åzœáz±åz±åz±æz±åz±åz±åzœáz±åz±åz±æz±åz±åz±åz

Chains

Apr 18, 2024

Subject

Serial Number

3a:02:06:9d:08:4a:9b:ae:45:54:63:5c:0d:b9:5a:8d

Issuer

Timespan

Apr 13, 2024 - Apr 14, 2034

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 3, 2023 - Aug 2, 2034

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

7973554

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

284KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vmp(¿R

Size

Virtual Size

199KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.themida

Size

Virtual Size

4.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp(¿R

Size

Virtual Size

403KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp(¿R

Size

1024B

Virtual Size

976B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp(¿R

Size

3.6MB

Virtual Size

3.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_MEM_READ

Name

.rsrc

Size

199KB

Virtual Size

199KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

fcc22a367ed0a8d8de94f5159ab12c32606f97326b832eb47327b7707ba457a6.exe

PE Signature issue

kernel32

user32

advapi32

shell32

ole32

oleaut32

generic