3da8f1b96363cbb5e3fe3da6abbd7b11_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3da8f1b96363cbb5e3fe3da6abbd7b11_JaffaCakes118
Size

1.4MB
MD5

3da8f1b96363cbb5e3fe3da6abbd7b11
SHA1

0057bb5051ea93c3ba23ee5fb527cc62d215bbe8
SHA256

dbf6e8d887ad3059ac048540af8201f618df221414bb34bc4d5f56a7e82c11c8
SHA512

c514ba988670f4d67b054d34fcabf0d83149888da4b485de8d7d6f230dae90a8f1e8ae7f4551ea33dd5e891ffb6df268459ff0751eb19cbe2892b63e2f10aa3d
SSDEEP

24576:7MpSNlYhCIzD0r+SutHcnRGISa1m0OfhZnZgNWAQ/9QT0oMXDpEjw:7MpnhlSKRMGIj1fkhtZgNUlQT0oV

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3da8f1b96363cbb5e3fe3da6abbd7b11_JaffaCakes118

Files

3da8f1b96363cbb5e3fe3da6abbd7b11_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

Size: 347KB - Virtual size: 736KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MaskPE
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

��
Size: 80B - Virtual size: 80B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Themida
Size: 1.1MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE