e9603eff1fd11bf75e8ebcd25c20e0d0_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
e9603eff1fd11bf75e8ebcd25c20e0d0_JaffaCakes118
Size 2.8MB
Sample240409-gl2bgabf3x
SHA256 772814c11739d2583083414e693964ed7a2167ac61339cdfad344a656ed2b841
MD5 e9603eff1fd11bf75e8ebcd25c20e0d0
SHA1 8122768889fcaa3eb7b5bfca45806a1cf84578fc
SHA512 a3147658f9e7b07d11653d75b53b3abcf1a6c2b5076e09cf82f60449e1aae8f346c0655d16068538abfcd2810c36c93facf36d8e47c2c7b9627191d5346ec591
SSDEEP 49152:sJ9+HQ0UnyvfYaALpW6ucDFFPwH8tAMfJ4tL3VGS1GmsoYeF5D4utupKBl:saHQ0pYtLpW9oCHM5fJ45lV1GmsbqMNm
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e9603eff1fd11bf75e8ebcd25c20e0d0_JaffaCakes118

File Explorer

e9603eff1fd11bf75e8ebcd25c20e0d0_JaffaCakes118

.exe 2.8MB

e9603eff1fd11bf75e8ebcd25c20e0d0_JaffaCakes118

SHA256 772814c11739d2583083414e693964ed7a2167ac61339cdfad344a656ed2b841
MD5 e9603eff1fd11bf75e8ebcd25c20e0d0
SHA1 8122768889fcaa3eb7b5bfca45806a1cf84578fc
SHA512 a3147658f9e7b07d11653d75b53b3abcf1a6c2b5076e09cf82f60449e1aae8f346c0655d16068538abfcd2810c36c93facf36d8e47c2c7b9627191d5346ec591
SSDEEP 49152:sJ9+HQ0UnyvfYaALpW6ucDFFPwH8tAMfJ4tL3VGS1GmsoYeF5D4utupKBl:saHQ0pYtLpW9oCHM5fJ45lV1GmsbqMNm
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5591128

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

Size

341KB

Virtual Size

636KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

30KB

Virtual Size

142KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

4KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

97KB

Virtual Size

656KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.imports

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

170KB

Virtual Size

170KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

Virtual Size

3.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

e9603eff1fd11bf75e8ebcd25c20e0d0_JaffaCakes118

generic