9p3hvf6[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
9p3hvf6.exe
Size 9.4MB
Sample260705-tcxcdadv61
SHA256 d5041f7a3a17ce8ebd395ef3d6ff0ccc064f7e5297a187d5e6f538c9bde4050f
MD5 ebe0aedc9befe869bef32bc63e3716a7
SHA1 87b9a06b3ff94d67fb15b960bb9e283a54a44cbf
SHA512 6c98a568bee6d0a8781b481d19a685886aa572954e87d32dea1ffe863c0b20b6195bbd246f06724c8cc202fa9930cc293258f10d0f337fdeeac17cb6353a1ac0
SSDEEP 196608:M2jpvNC14u6+6zsPPfAiH9d0cWc2xw91z8TyHsKQL7qrRhqHtVqCuAY7:bjpvNC1O+44fA00cqknHsdL7qrHqNVq1
TLSH
T1F6A6336B30043CA2E4F763BA7DB5048649B6F825CE83786AE41F03D98B66B4DDB75710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
9p3hvf6.exe

File Explorer

9p3hvf6.exe

.exe 9.4MB

9p3hvf6.exe

SHA256 d5041f7a3a17ce8ebd395ef3d6ff0ccc064f7e5297a187d5e6f538c9bde4050f
MD5 ebe0aedc9befe869bef32bc63e3716a7
SHA1 87b9a06b3ff94d67fb15b960bb9e283a54a44cbf
SHA512 6c98a568bee6d0a8781b481d19a685886aa572954e87d32dea1ffe863c0b20b6195bbd246f06724c8cc202fa9930cc293258f10d0f337fdeeac17cb6353a1ac0
SSDEEP 196608:M2jpvNC14u6+6zsPPfAiH9d0cWc2xw91z8TyHsKQL7qrRhqHtVqCuAY7:bjpvNC1O+44fA00cqknHsdL7qrHqNVq1
TLSH
T1F6A6336B30043CA2E4F763BA7DB5048649B6F825CE83786AE41F03D98B66B4DDB75710
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Digest

40:37:1f:c7:b1:52:75:58:30:95:96:69:e4:a9:9d:2f:c6:be:e8:0f

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Manthe Industries LLC,O=Manthe Industries LLC,L=De Pere,ST=Wisconsin,C=US

Chains

Jul 2, 2026

CN=Manthe Industries LLC,O=Manthe Industries LLC,L=De Pere,ST=Wisconsin,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Minor OS version

Major OS version

Entry point

16445528

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

Size

1.4MB

Virtual Size

3.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

338KB

Virtual Size

982KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

136KB

Virtual Size

489KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

117KB

Virtual Size

219KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

43KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

8KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

Virtual Size

10.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

7.3MB

Virtual Size

7.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

16B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ

generic

count=21, id=259, version=29395,

count=206, id=261, version=29395,

count=6, id=261, productName=VS2017 v15.9.1 build 27023, version=27023,

count=2, id=253, version=32533,

count=20, id=260, version=32533,

count=12, id=259, version=32533,

count=2, id=123, version=2207,

count=99, id=261, version=32533,

count=25, id=260, version=29395,

count=6, id=260, productName=VS2017 v15.9.5 build 27026, version=27026,

count=26, id=260, version=25830,

count=1, id=224, productName=VS2013 UPD5 build 40629, version=40629,

count=33, id=261, productName=VS2017 v15.3 build 25506, version=25506,

count=1, id=259, productName=VS2017 v15.3 build 25506, version=25506,

count=480, id=260, version=24231,

count=14, id=260, version=27045,

count=33, id=257, version=29395,

count=476, id=1, productName=Unmarked objects,

count=147, id=265, version=32824,

count=1, id=255, version=32824,

count=1, id=258, version=32824,