29db7964fbd55a4a2e956ff9012eff20_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

29db7964fbd55a4a2e956ff9012eff20_JaffaCakes118
Size

7.8MB
MD5

29db7964fbd55a4a2e956ff9012eff20
SHA1

8a1c396f019009de05c18d8f81b1477308159e2b
SHA256

916c743524217e12bf563236b620e7a3bb680d000ea65cc326db980f55168c3d
SHA512

945a3b80731041d9bc0b5bfc772aef8b9c766faae00bb25995ef3ed333975397969826921f18026380e449264a5eac41a98d212d75e7c84217c1e550814b958c
SSDEEP

196608:JFf3WKFTI48WrAu4EZE8Ug73SPXPZLeDeAC6fXXFcb:JFf3FFF8Zu4+UnvADeA5XVu

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
29db7964fbd55a4a2e956ff9012eff20_JaffaCakes118

Files

29db7964fbd55a4a2e956ff9012eff20_JaffaCakes118
.exe windows:5 windows x86 arch:x86

cdb21c208d7ed4f49460783828847ba5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

UpdateLayeredWindow
DestroyIcon
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW

kernel32

GetVersion
GetVersionExA
GetVersionExA
GetVersion
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

gdi32

SelectObject
Ellipse

gdiplus

GdipCreateBitmapFromScan0

ole32

CreateStreamOnHGlobal

imm32

ImmReleaseContext

shell32

ShellExecuteA
ShellExecuteA

shlwapi

PathFileExistsA

winmm

PlaySoundA
midiOutUnprepareHeader

msvfw32

DrawDibDraw

avifil32

AVIStreamInfoA

rasapi32

RasGetConnectStatusA

ws2_32

gethostbyname

msimg32

TransparentBlt

winspool.drv

OpenPrinterA

comdlg32

GetOpenFileNameA

advapi32

RegCreateKeyExA

oleaut32

GetErrorInfo

comctl32

ImageList_GetImageInfo

wininet

InternetCloseHandle

wtsapi32

WTSSendMessageW

Sections

.text
Size: - Virtual size: 3.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 4.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: - Virtual size: 760KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 7.8MB - Virtual size: 7.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

cdb21c208d7ed4f49460783828847ba5

Headers

File Characteristics

Imports

user32

kernel32

gdi32

gdiplus

ole32

imm32

shell32

shlwapi

winmm

msvfw32

avifil32

rasapi32

ws2_32

msimg32

winspool.drv

comdlg32

advapi32

oleaut32

comctl32

wininet

wtsapi32

Sections

.text Size: - Virtual size: 3.2MB

.rdata Size: - Virtual size: 4.8MB

.data Size: - Virtual size: 760KB

.vmp0 Size: - Virtual size: 3.1MB

.vmp1 Size: 7.8MB - Virtual size: 7.8MB

.rsrc Size: 8KB - Virtual size: 4KB

.text
Size: - Virtual size: 3.2MB

.rdata
Size: - Virtual size: 4.8MB

.data
Size: - Virtual size: 760KB

.vmp0
Size: - Virtual size: 3.1MB

.vmp1
Size: 7.8MB - Virtual size: 7.8MB

.rsrc
Size: 8KB - Virtual size: 4KB