ed2154f2c0bf7c1b72bedfd1f3b53970_JaffaCakes118 | Triage

Sharing

General

Target

ed2154f2c0bf7c1b72bedfd1f3b53970_JaffaCakes118
Size

6.1MB
MD5

ed2154f2c0bf7c1b72bedfd1f3b53970
SHA1

0be5f9057dd8f985a53869fcc7d4abf6a6af4b9a
SHA256

f413f6ce30e774d6f6854572b3311364c94a4b7db20de80fab34a703f2f3b4cf
SHA512

d360ab5fcd78703e7842a67e9e59914167371eb63f5e0cfa21b22e079d5063217f249f04f0ad6e0fc4ab955cb3c9d1ee11ab1c54aa9133d1d1da782cef0f05af
SSDEEP

98304:yNVwfY4cAa6k58knYaqshaYl4mcUusbB6JXA9VlXg7I/nCGi8PY2tUqCPOWE4llR:AR8WindvUuYB6UVPcE4GWjC/Xil6Ppk

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ed2154f2c0bf7c1b72bedfd1f3b53970_JaffaCakes118

Files

ed2154f2c0bf7c1b72bedfd1f3b53970_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 3.2MB - Virtual size: 5.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.imports
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.themida
Size: - Virtual size: 4.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ