ed2154f2c0bf7c1b72bedfd1f3b53970_JaffaCakes118

General

Target
ed2154f2c0bf7c1b72bedfd1f3b53970_JaffaCakes118
Size 6.1MB
Sample240411-lrtk2aca7x
SHA256 f413f6ce30e774d6f6854572b3311364c94a4b7db20de80fab34a703f2f3b4cf
MD5 ed2154f2c0bf7c1b72bedfd1f3b53970
SHA1 0be5f9057dd8f985a53869fcc7d4abf6a6af4b9a
SHA512 d360ab5fcd78703e7842a67e9e59914167371eb63f5e0cfa21b22e079d5063217f249f04f0ad6e0fc4ab955cb3c9d1ee11ab1c54aa9133d1d1da782cef0f05af
SSDEEP 98304:yNVwfY4cAa6k58knYaqshaYl4mcUusbB6JXA9VlXg7I/nCGi8PY2tUqCPOWE4llR:AR8WindvUuYB6UVPcE4GWjC/Xil6Ppk
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ed2154f2c0bf7c1b72bedfd1f3b53970_JaffaCakes118

File Explorer

ed2154f2c0bf7c1b72bedfd1f3b53970_JaffaCakes118

.exe 6.1MB

ed2154f2c0bf7c1b72bedfd1f3b53970_JaffaCakes118

SHA256 f413f6ce30e774d6f6854572b3311364c94a4b7db20de80fab34a703f2f3b4cf
MD5 ed2154f2c0bf7c1b72bedfd1f3b53970
SHA1 0be5f9057dd8f985a53869fcc7d4abf6a6af4b9a
SHA512 d360ab5fcd78703e7842a67e9e59914167371eb63f5e0cfa21b22e079d5063217f249f04f0ad6e0fc4ab955cb3c9d1ee11ab1c54aa9133d1d1da782cef0f05af
SSDEEP 98304:yNVwfY4cAa6k58knYaqshaYl4mcUusbB6JXA9VlXg7I/nCGi8PY2tUqCPOWE4llR:AR8WindvUuYB6UVPcE4GWjC/Xil6Ppk
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10551384

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

Size

3.2MB

Virtual Size

5.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

85KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.imports

Size

512B

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.themida

Size

Virtual Size

4.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ed2154f2c0bf7c1b72bedfd1f3b53970_JaffaCakes118

generic