7c1e63840584f07bd1e1436a02c7b65375fbf6c80ab289aaf2a5d16d63804737[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
7c1e63840584f07bd1e1436a02c7b65375fbf6c80ab289aaf2a5d16d63804737.bin
Size 5.1MB
Sample260822-2c8dmszfje
SHA256 7c1e63840584f07bd1e1436a02c7b65375fbf6c80ab289aaf2a5d16d63804737
MD5 6df2a62bd8dbcfa4561a5eec4bf3f643
SHA1 d973120cb5d1f8e47bcd4b3a10a278e4494ab028
SHA512 6f6050a661c7107b3b022351e74df49a5a87205b1e2adf3456e4eb6e700f6379d31d3517d327964c5103caab2c178aa591f2912c424e51217b49f5cfa4811d46
SSDEEP 98304:Kk3eRUmxjssDukD2jhS+UhaMNaO1dR0W6pq0Ny:KHxxjssuHhf/caO1Kg0Ny
TLSH
T1B63622A27F05D801D4960E74CA76C3E9A720FD08DE85935B31EAAF2FFDE62D25D02185
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
7c1e63840584f07bd1e1436a02c7b65375fbf6c80ab289aaf2a5d16d63804737.bin

File Explorer

7c1e63840584f07bd1e1436a02c7b65375fbf6c80ab289aaf2a5d16d63804737.bin

.exe 5.1MB

7c1e63840584f07bd1e1436a02c7b65375fbf6c80ab289aaf2a5d16d63804737.bin

SHA256 7c1e63840584f07bd1e1436a02c7b65375fbf6c80ab289aaf2a5d16d63804737
MD5 6df2a62bd8dbcfa4561a5eec4bf3f643
SHA1 d973120cb5d1f8e47bcd4b3a10a278e4494ab028
SHA512 6f6050a661c7107b3b022351e74df49a5a87205b1e2adf3456e4eb6e700f6379d31d3517d327964c5103caab2c178aa591f2912c424e51217b49f5cfa4811d46
SSDEEP 98304:Kk3eRUmxjssDukD2jhS+UhaMNaO1dR0W6pq0Ny:KHxxjssuHhf/caO1Kg0Ny
TLSH
T1B63622A27F05D801D4960E74CA76C3E9A720FD08DE85935B31EAAF2FFDE62D25D02185
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

25:f5:d9:7a:a7:20:9d:e6:d7:00:c2:73:5f:66:c0:e3:7a:b0:0a:6f:8b:e4:44:68:ba:ff:c1:d2:89:f8:59:82

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Launcher,OU=Infrastructure,O=FairDale Edge Tools OU,L=Rotterdam,C=NL

Chains

Aug 22, 2026

CN=Launcher,OU=Infrastructure,O=FairDale Edge Tools OU,L=Rotterdam,C=NL

PE Signature issue

Digest

10:15:5b:bb:85:37:51:66:ab:92:f3:a1:87:14:2f:9f:97:0e:6c:19

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Launcher,OU=Infrastructure,O=FairDale Edge Tools OU,L=Rotterdam,C=NL

Chains

Aug 22, 2026

CN=Launcher,OU=Infrastructure,O=FairDale Edge Tools OU,L=Rotterdam,C=NL

Subject

CN=Launcher,OU=Infrastructure,O=FairDale Edge Tools OU,L=Rotterdam,C=NL

Serial Number

6d:36:cd:65:f8:22:ac:ac:4d:a7:ed:d6:8e:5f:6f:58

Issuer

CN=Launcher,OU=Infrastructure,O=FairDale Edge Tools OU,L=Rotterdam,C=NL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 22, 2026 - Aug 22, 2028

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Subject

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Serial Number

90:ac:08:72:20:fd:c5:a7:c4:6b:5c:c7:0d:f7:3d:06

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Mar 24, 2041

Subject

CN=Sectigo Public Time Stamping Signer R37,O=Sectigo Limited,ST=Greater London,C=GB

Serial Number

e7:4e:f2:55:b0:50:4f:fa:db:a6:df:f7:fc:8b:a3:15

Issuer

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Jun 24, 2037

Minor OS version

Major OS version

Entry point

7250008

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

Size

172KB

Virtual Size

315KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

34KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

18KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

512B

Virtual Size

28B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

280KB

Virtual Size

279KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.themida

Size

Virtual Size

6.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

4.6MB

Virtual Size

4.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

7c1e63840584f07bd1e1436a02c7b65375fbf6c80ab289aaf2a5d16d63804737.bin

PE Signature issue

PE Signature issue

generic