bcb321b760431ab9a5a12aea71a37715_JaffaCakes118

General

Target
bcb321b760431ab9a5a12aea71a37715_JaffaCakes118
Size 2.8MB
Sample240404-tlwgfacg53
SHA256 bc6e619b0ae22bb0c5a6e45b583df25c693c8aaeebd90da27a8c00d68d46b0ec
MD5 bcb321b760431ab9a5a12aea71a37715
SHA1 c73b37cf8edb1e3c252caf5e34b72a77f8d2155b
SHA512 77619d37fdc66f6661acf98a8f9d410b906d3e094767038c5f219439605476abffcba55c335005d713a938207c3d9060b647b25d42aa41ea0d1e9014c34489c0
SSDEEP 49152:VqKD3iK9bjOieRF9Rchs3/IduOl8k7yq4hRlqSX2hso83qVFz0beO:FpbAP96heRkO7RRBw69
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bcb321b760431ab9a5a12aea71a37715_JaffaCakes118

File Explorer

bcb321b760431ab9a5a12aea71a37715_JaffaCakes118

.exe 2.8MB

bcb321b760431ab9a5a12aea71a37715_JaffaCakes118

SHA256 bc6e619b0ae22bb0c5a6e45b583df25c693c8aaeebd90da27a8c00d68d46b0ec
MD5 bcb321b760431ab9a5a12aea71a37715
SHA1 c73b37cf8edb1e3c252caf5e34b72a77f8d2155b
SHA512 77619d37fdc66f6661acf98a8f9d410b906d3e094767038c5f219439605476abffcba55c335005d713a938207c3d9060b647b25d42aa41ea0d1e9014c34489c0
SSDEEP 49152:VqKD3iK9bjOieRF9Rchs3/IduOl8k7yq4hRlqSX2hso83qVFz0beO:FpbAP96heRkO7RRBw69
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

4898904

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

Size

218KB

Virtual Size

420KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

43KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

1KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

16KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.imports

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.themida

Size

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

bcb321b760431ab9a5a12aea71a37715_JaffaCakes118

generic