8c1af561b3c0d58dfe8805b7507d1d7eaf220163ffd8cd90d8e84147694e20bd

Sharing

Copy URL

Twitter E-mail

General

Target

8c1af561b3c0d58dfe8805b7507d1d7eaf220163ffd8cd90d8e84147694e20bd
Size

2.7MB
MD5

eb5938ac317cced8dd34cbbc8de04c44
SHA1

5d3461337545f491c618972f38235da4b3c279b0
SHA256

8c1af561b3c0d58dfe8805b7507d1d7eaf220163ffd8cd90d8e84147694e20bd
SHA512

ded3cde99aa579f5dea67452ab5f0092dc4993daa38798829c51f28fa32d0b29029597fb9534f586396babf49e8c41a7589cae53ccdc7148c2331297f79a4714
SSDEEP

49152:1+gOl3uRq/k385/qW5Ox5ioNpHtDONjdu87HhEH8rOS+7LrE0UFVn:gVJxSW5K5io9DONjJhA8yS+7LA0UFV

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
static1/unpack001/EA/jaegerbomb/Jaegerbomb.exe	themida

Files

8c1af561b3c0d58dfe8805b7507d1d7eaf220163ffd8cd90d8e84147694e20bd
.rar
EA/Directions.txt
EA/EasyAccount.exe
.exe windows x86

5a4c62537343894ae34b0e239010f4ba

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

MethCallEngine
ord519
ord595
EVENT_SINK_AddRef
DllFunctionCall
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler
ProcCallEngine
ord537
ord645
ord573
ord578
ord100
ord617
ord619

Sections

.text
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
EA/ReadMe.txt
EA/jaegerbomb/Jaegerbomb.exe
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 922KB - Virtual size: 2.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Themida
Size: 1.8MB - Virtual size: 3.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
EA/jaegerbomb/LICENCE
EA/jaegerbomb/config
EA/oldplayerstats.txt
EA/playerstats.txt

Sharing

General

Malware Config

Signatures

Files

5a4c62537343894ae34b0e239010f4ba

Headers

File Characteristics

Imports

msvbvm60

Sections

.text Size: 28KB - Virtual size: 26KB

.data Size: - Virtual size: 4KB

.rsrc Size: 16KB - Virtual size: 13KB

Headers

DLL Characteristics

File Characteristics

Sections

Size: 922KB - Virtual size: 2.4MB

.rsrc Size: 1024B - Virtual size: 1KB

.idata Size: 512B - Virtual size: 4KB

Themida Size: 1.8MB - Virtual size: 3.6MB

.text
Size: 28KB - Virtual size: 26KB

.data
Size: - Virtual size: 4KB

.rsrc
Size: 16KB - Virtual size: 13KB

.rsrc
Size: 1024B - Virtual size: 1KB

.idata
Size: 512B - Virtual size: 4KB

Themida
Size: 1.8MB - Virtual size: 3.6MB