eef1b265e3aeaaeafabfe74bda31b5cf_JaffaCakes118

General

Target
eef1b265e3aeaaeafabfe74bda31b5cf_JaffaCakes118
Size 3.1MB
Sample240412-c73n7scg97
SHA256 c5203826395626892dba5e237dafd85fa8370264c9d150ffeee86c261930e065
MD5 eef1b265e3aeaaeafabfe74bda31b5cf
SHA1 924a445a8fc23c29fe1b294272cb8c8e5ba9c7bb
SHA512 66ce9210947a9901694d8b71ce2ff83e06d31c9af158b0fd507444918af59edd74604a0f81bc45aeb07e7a47c7b84c0a38c6db77da2cf4917036e4515869abc1
SSDEEP 49152:B6Ovl41Ww2/TxmN/UyuTGHlhXkUGPPeMdmyaDhg9EKkdTgpR56/+iX8k9BPUoh4b:IOvKnqxuVutPPePlOS/+KBrhK
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
eef1b265e3aeaaeafabfe74bda31b5cf_JaffaCakes118

File Explorer

eef1b265e3aeaaeafabfe74bda31b5cf_JaffaCakes118

.exe 3.1MB

eef1b265e3aeaaeafabfe74bda31b5cf_JaffaCakes118

SHA256 c5203826395626892dba5e237dafd85fa8370264c9d150ffeee86c261930e065
MD5 eef1b265e3aeaaeafabfe74bda31b5cf
SHA1 924a445a8fc23c29fe1b294272cb8c8e5ba9c7bb
SHA512 66ce9210947a9901694d8b71ce2ff83e06d31c9af158b0fd507444918af59edd74604a0f81bc45aeb07e7a47c7b84c0a38c6db77da2cf4917036e4515869abc1
SSDEEP 49152:B6Ovl41Ww2/TxmN/UyuTGHlhXkUGPPeMdmyaDhg9EKkdTgpR56/+iX8k9BPUoh4b:IOvKnqxuVutPPePlOS/+KBrhK
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5578840

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

Size

2KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

670B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

16B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.imports

Size

512B

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

Virtual Size

5.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

eef1b265e3aeaaeafabfe74bda31b5cf_JaffaCakes118

generic