1502754682cc683276f4fc8eb667153b039948f87b11846d9d57eb33dee4a79a

Sharing

Copy URL Twitter E-mail

General

Target
1502754682cc683276f4fc8eb667153b039948f87b11846d9d57eb33dee4a79a
Size 7.4MB
Sample261011-e8q3xady5r
SHA256 1502754682cc683276f4fc8eb667153b039948f87b11846d9d57eb33dee4a79a
MD5 2896fb26e3d36d050390d22d593b61df
SHA1 a62d625585230b6a4238590195c9aa2a787a79c0
SHA512 080df1897149b0735fc4365b459481bc7ea4416ecee7b9720e0dd678e6558dca2f2f0e62ad40cdfd6e3782e7c17b5cc5ca3ef199c00dd9d4bfedb5fe0657c2f5
SSDEEP 196608:KcRAImlKjMGZLHK9/g1OwyzHv6LNcigd9b+ou92:KcRAImlKjMGZLq9YM7v6C9Lc2
TLSH
T1B5763384F09E47F5D17CADBEC05AAD0EB395E7B1466387CB0A423DB88D81E77B0A4581
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
1502754682cc683276f4fc8eb667153b039948f87b11846d9d57eb33dee4a79a

File Explorer

1502754682cc683276f4fc8eb667153b039948f87b11846d9d57eb33dee4a79a

.exe 7.4MB

1502754682cc683276f4fc8eb667153b039948f87b11846d9d57eb33dee4a79a

SHA256 1502754682cc683276f4fc8eb667153b039948f87b11846d9d57eb33dee4a79a
MD5 2896fb26e3d36d050390d22d593b61df
SHA1 a62d625585230b6a4238590195c9aa2a787a79c0
SHA512 080df1897149b0735fc4365b459481bc7ea4416ecee7b9720e0dd678e6558dca2f2f0e62ad40cdfd6e3782e7c17b5cc5ca3ef199c00dd9d4bfedb5fe0657c2f5
SSDEEP 196608:KcRAImlKjMGZLHK9/g1OwyzHv6LNcigd9b+ou92:KcRAImlKjMGZLq9YM7v6C9Lc2
TLSH
T1B5763384F09E47F5D17CADBEC05AAD0EB395E7B1466387CB0A423DB88D81E77B0A4581
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

33:9e:4b:a4:8e:18:f2:f8:20:4b:c1:ff:a5:0e:f8:d1:28:2f:a3:11:bb:a5:df:de:7e:df:01:47:ec:35:67:47:ba:ee:38:b9:d3:1d:fd:ae:57:d1:0d:0a:19:14:10:58:d7:b5:50:28:31:df:2c:f3:83:49:2c:6e:34:ca:a4:d8

Digest Algorithm

sha512

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Windows Hardware Compatibility Publisher,C=CN

Chains

Jan 1, 0001

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,C=US

Serial Number

78:d3:e6:11:89:ba:6e:cf:bb:48:9a:f5:33:17:10:03:cd:07:70:ca

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Sep 14, 2026 - Sep 11, 2036

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Windows Hardware Compatibility Publisher,C=CN

Serial Number

29:19:96:bc:bb:6c:a7:31:aa:29:15:9b:47:7d:11:07:ea:ba:06:73

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 14, 2026 - Sep 14, 2027

Subject

CN=DigiCert SHA512 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

0c:68:21:84:d3:7f:b8:56:8e:82:5f:c5:d6:18:f6:30

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

11337816

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

Size

157KB

Virtual Size

261KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

73KB

Virtual Size

140KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

2.1MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

4KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

1024B

Virtual Size

904B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

Virtual Size

8.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

5.1MB

Virtual Size

5.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

16B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

1502754682cc683276f4fc8eb667153b039948f87b11846d9d57eb33dee4a79a

PE Signature issue

generic