20ea694695293e1e392aa35de7143c81_JaffaCakes118 | Triage

Sharing

General

Target

20ea694695293e1e392aa35de7143c81_JaffaCakes118
Size

996KB
MD5

20ea694695293e1e392aa35de7143c81
SHA1

39bf99f6c295384b4db421e3009c219e7b6afd16
SHA256

d8d91c6303a2e871f71f21726a300dedfc6030a2f0a62910c7e750595ead746d
SHA512

5f7d0e0cba89beaef82e5855537c71fbf56a09e0b1745c286dfe163a7d39e8d9a99928f11185db3aaafea25dff44dc020ff396ef94e717a284eb098cb83a1169
SSDEEP

24576:E4EI15kGroh7CXKllt0Mh+ZNE/sMJ2R0Ssyq/ZjBhfY:II1GDh+01Wq//hfY

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
20ea694695293e1e392aa35de7143c81_JaffaCakes118

Files

20ea694695293e1e392aa35de7143c81_JaffaCakes118
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 428KB - Virtual size: 428KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Themida
Size: 562KB - Virtual size: 568KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE