e9321013d5acb2c4748e1fdc73eaf3b1_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e9321013d5acb2c4748e1fdc73eaf3b1_JaffaCakes118
Size

17.7MB
MD5

e9321013d5acb2c4748e1fdc73eaf3b1
SHA1

7df06af133a590e7c080e3c3fdaa69b0a9452173
SHA256

1ae8772c13e7a78e8426aaf37a834ef0637f1897f006c457e0ebaf761fb6f203
SHA512

0b6402bb099e4bc1a73f3b437ef386aa97a0213ff2d3e14cfd727c5928da89561037d1b4d25bd343091c38a47958693dc74ecac8b34926c8e9883f83205e7d03
SSDEEP

393216:8l3zl32nC/Oq0nyLo+cr7TjZSOo208ozQwfq4p4X1rvARQibF:VCB0nJjZ4208dwV4FvARj

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e9321013d5acb2c4748e1fdc73eaf3b1_JaffaCakes118

Files

e9321013d5acb2c4748e1fdc73eaf3b1_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Size: 14.7MB - Virtual size: 14.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 15B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.imports
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 5.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ