057bcbfebfd259541fb9b0ce038b3542_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

057bcbfebfd259541fb9b0ce038b3542_JaffaCakes118
Size

1024KB
MD5

057bcbfebfd259541fb9b0ce038b3542
SHA1

9366f21a62fa925b39fbdb77bb6d0ad1c704689d
SHA256

b2bb71fe93748507124fc128d651b59872cd30051f758d897cd87c112adc2f99
SHA512

21a827c50e32401a6be2d83074a7a8a4a24faa29dcd8e6f07f9dee3d6b29e54b904e306864b485f9d5cdce9943ac122b3be1b7d009a92160933eeb40b6fc82ec
SSDEEP

24576:YyT6n/DfSbIrt7A+uLKbQtxSo1E0NO+bv2Bnnh:ZWn/HnBstxjvynh

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Files

057bcbfebfd259541fb9b0ce038b3542_JaffaCakes118
.exe windows:5 windows x86 arch:x86

Code Sign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6f:8a:c6:73:ee:74:6c:94:91:e0:38:54:91:ec:12:a0
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

24/09/2009, 00:00

Not After

23/09/2012, 23:59

Subject

CN=Guangzhou Feiteng Network Technology Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Guangzhou Feiteng Network Technology Co.\, Ltd.,L=Guangzhou,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

28:63:df:cb:03:f6:70:c1:be:6c:46:1e:39:eb:db:0e:8a:27:21:fd
Signer

Actual PE Digest

28:63:df:cb:03:f6:70:c1:be:6c:46:1e:39:eb:db:0e:8a:27:21:fd

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Exports

Exports

??0CxFile@@QAE@ABV0@@Z
??0CxFile@@QAE@XZ
??0CxIOFile@@QAE@ABV0@@Z
??0CxIOFile@@QAE@PAU_iobuf@@@Z
??0CxMemFile@@QAE@ABV0@@Z
??1CxFile@@UAE@XZ
??1CxIOFile@@UAE@XZ
??1CxImage@@UAE@XZ
??4CxFile@@QAEAAV0@ABV0@@Z
??4CxIOFile@@QAEAAV0@ABV0@@Z
??4CxMemFile@@QAEAAV0@ABV0@@Z
??_7CxFile@@6B@
??_7CxIOFile@@6B@
??_7CxImage@@6B@
??_7CxMemFile@@6B@
??_FCxIOFile@@QAEXXZ
??_FCxImage@@QAEXXZ
??_FCxMemFile@@QAEXXZ
??_OCxImage@@QAEXAAV0@@Z
?Close@CxIOFile@@UAE_NXZ
?Eof@CxIOFile@@UAE_NXZ
?Error@CxIOFile@@UAEJXZ
?Flush@CxIOFile@@UAE_NXZ
?GetC@CxIOFile@@UAEJXZ
?GetS@CxIOFile@@UAEPADPADH@Z
?Open@CxIOFile@@QAE_NPBD0@Z
?PutC@CxFile@@UAE_NE@Z
?PutC@CxIOFile@@UAE_NE@Z
?Read@CxIOFile@@UAEIPAXII@Z
?Scanf@CxIOFile@@UAEJPBDPAX@Z
?Seek@CxIOFile@@UAE_NJH@Z
?Size@CxIOFile@@UAEJXZ
?Tell@CxIOFile@@UAEJXZ
?Write@CxIOFile@@UAEIPBXII@Z
init_debug
init_frozen
init_weplay
init_weplay_agents_swf
init_weplay_crypt
init_weplay_crypt_CCrypt
initbond

Sections

Size: 159KB - Virtual size: 520KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 90KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Themida
Size: 759KB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Code Sign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

6f:8a:c6:73:ee:74:6c:94:91:e0:38:54:91:ec:12:a0Certificate

Extended Key Usages

Key Usages

28:63:df:cb:03:f6:70:c1:be:6c:46:1e:39:eb:db:0e:8a:27:21:fdSigner

Headers

DLL Characteristics

File Characteristics

Exports

Exports

Sections

Size: 159KB - Virtual size: 520KB

.rsrc Size: 90KB - Virtual size: 89KB

.idata Size: 512B - Virtual size: 4KB

Themida Size: 759KB - Virtual size: 1.7MB

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

6f:8a:c6:73:ee:74:6c:94:91:e0:38:54:91:ec:12:a0
Certificate

28:63:df:cb:03:f6:70:c1:be:6c:46:1e:39:eb:db:0e:8a:27:21:fd
Signer

.rsrc
Size: 90KB - Virtual size: 89KB

.idata
Size: 512B - Virtual size: 4KB

Themida
Size: 759KB - Virtual size: 1.7MB