Patch_327[.]zip | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Patch_327.zip
Size 7.5MB
Sample260723-wzzgcsvbkc
SHA256 1fc6276df83eec6e73e918f489d664d15f365db1af1149b02c7e0b2fbaac4801
MD5 f9233a5668fb40fefb1023e29078d00c
SHA1 e74a591d379de8399a38d02d8bd9ce6f7318da65
SHA512 494ed764037491be6af2a675ba0d67341cf33ece210fb8bb46f4caa9d9d9465f8d7a9e35eb938000a8ab152ef88d34beaa21a12bff4d56c7cc0f589c6c911af9
SSDEEP 196608:PgAEbjJTllKpU0fsc28nRxcXXOLRb60So7jIg+9LJCM:PnE/JbKpU0X0Od2K7jIguCM
TLSH
T1F2763344ACE37673195D47BCF6B15BE40D3234A0116E411EBB96E74F4FEE80E1BA0A86
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
static1/unpack001/DigimonRPG.bin	themida

File Explorer

Patch_327.zip

.zip 7.5MB
DigimonRPG.bin

.exe 6.5MB
patch_327.hf

179B
patch_327.pf

2KB
table.hf

1KB
table.pf

1.1MB

Patch_327.zip

SHA256 1fc6276df83eec6e73e918f489d664d15f365db1af1149b02c7e0b2fbaac4801
MD5 f9233a5668fb40fefb1023e29078d00c
SHA1 e74a591d379de8399a38d02d8bd9ce6f7318da65
SHA512 494ed764037491be6af2a675ba0d67341cf33ece210fb8bb46f4caa9d9d9465f8d7a9e35eb938000a8ab152ef88d34beaa21a12bff4d56c7cc0f589c6c911af9
SSDEEP 196608:PgAEbjJTllKpU0fsc28nRxcXXOLRb60So7jIg+9LJCM:PnE/JbKpU0X0Od2K7jIguCM
TLSH
T1F2763344ACE37673195D47BCF6B15BE40D3234A0116E411EBB96E74F4FEE80E1BA0A86
MD5 SHA1 SHA512 SSDEEP TLSH

DigimonRPG.bin

SHA256 81b60fe097a92aa7ac82b012d9a16229055b9c4adda583c57be618ff4d1a91bb
MD5 28226696f070cc7a627051a12d2a931d
SHA1 e5a14f6e87f6ccd8031b09c459823d7b8b91190f
SHA512 076032aeae7a3386cc1697e24491969d15abfc3777587c7a87b0a470198a850223cfea2f5b14a09d560cbce1ff5bac0cdd480c7b52bacc73a8111534abe36c35
SSDEEP 196608:9dnRYwdhBNBTQpI5Tk8oolZsltr8GwhY/Do1lMSkdDthD:9wwbBbQpI53lStr8Pq/Do1QdDt5
TLSH
T15C6623B254827ED3D66A83F97C2385444C36F5360F560678F12F9BAA829A11DCFF1B84
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Themida packer

Detects Themida, an advanced Windows software protection system.

themida

Digest

b2:4a:b1:50:6d:53:16:74:e5:e5:83:71:07:4c:b3:8f:84:68:5c:ad:e4:6b:ce:de:c3:fe:41:bc:36:c6:2f:4a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=MOVE INTERACTIVE Co.\,Ltd.,O=MOVE INTERACTIVE Co.\,Ltd.,ST=Seoul,C=KR

Chains

Jan 4, 2023

CN=MOVE INTERACTIVE Co.\,Ltd.,O=MOVE INTERACTIVE Co.\,Ltd.,ST=Seoul,C=KR

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=MOVE INTERACTIVE Co.\,Ltd.,O=MOVE INTERACTIVE Co.\,Ltd.,ST=Seoul,C=KR

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Digest

45:e8:7b:4c:e3:ea:ea:91:ff:a0:6c:41:5d:c6:3d:61:61:97:58:5e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=MOVE INTERACTIVE Co.\,Ltd.,O=MOVE INTERACTIVE Co.\,Ltd.,ST=Seoul,C=KR

Chains

Jan 4, 2023

CN=MOVE INTERACTIVE Co.\,Ltd.,O=MOVE INTERACTIVE Co.\,Ltd.,ST=Seoul,C=KR

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=MOVE INTERACTIVE Co.\,Ltd.,O=MOVE INTERACTIVE Co.\,Ltd.,ST=Seoul,C=KR

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=MOVE INTERACTIVE Co.\,Ltd.,O=MOVE INTERACTIVE Co.\,Ltd.,ST=Seoul,C=KR

Serial Number

2d:9b:c3:38:9f:41:d8:59:85:0c:e1:ef:c2:cc:11:70

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 31, 2022 - Oct 30, 2024

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

16539736

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Jenkins\workspace\Digimon_RPG_Live_Build_vs2017\bin\Give\DigimonRPG.pdb

Name

Size

2.8MB

Virtual Size

7.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

428KB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

51KB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

1KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

188KB

Virtual Size

319KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.debug

Size

1KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

Virtual Size

4.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

16B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ

generic

count=27, id=241, version=40116,

count=195, id=243, version=40116,

count=34, id=242, version=40116,

count=1, id=208, version=65501,

count=7, id=199, version=41118,

count=27, id=259, version=26706,

count=38, id=260, version=26706,

count=6, id=206, version=65501,

count=10, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=44, id=265, version=27048,

count=640, id=260, version=27034,

count=5, id=260, version=24234,

count=14, id=261, version=24234,

count=135, id=261, version=26706,

count=22, id=10, productName=VS98 (6.0) build 8168, version=8168,

count=1, id=28, version=9178,

count=4, id=25, version=9210,

count=1, id=29, version=9178,

count=35, id=203, version=65501,

count=413, id=1, productName=Unmarked objects,

count=450, id=261, version=27048,

count=1, id=255, version=27048,

count=1, id=151,

count=1, id=258, version=27048,

Sharing

General

Malware Config

Signatures

File Explorer

Patch_327.zip

DigimonRPG.bin

generic

patch_327.hf

patch_327.pf

table.hf

table.pf