JaffaCakes118_f36dce77ea4480e95d763db6c31b033e | Triage

Sharing

General

Target

JaffaCakes118_f36dce77ea4480e95d763db6c31b033e
Size

2.3MB
MD5

f36dce77ea4480e95d763db6c31b033e
SHA1

2a1e2d46856aae304dc7703efd7b3425437cbeeb
SHA256

4da051820aa16c3258fa1b3c276a42df4f5a6006ce820ae26bc0bcc3a3fef3a7
SHA512

ecf209722550ab1e1505ae01823414a70bbc3125a4d5a9611c0eeae60472d1189f6dcc8f70a7afb5347fcf18dafdc9d52d6ebe6acc06bbadcb58ca84e448707c
SSDEEP

49152:ng1296HTCVMxIDQeYBBUlwbqR2xQOD0d9dJwGlUa1GmbiyKUumFoT51R:nYCV9DQe692DOY9dGGlUaBKJmFW1R

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_f36dce77ea4480e95d763db6c31b033e

Files

JaffaCakes118_f36dce77ea4480e95d763db6c31b033e
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 45KB - Virtual size: 112KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.imports
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.themida
Size: - Virtual size: 3.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.taggant
Size: 8KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ