e451535b3434b5d314f84b567fc26f64_JaffaCakes118

General

Target
e451535b3434b5d314f84b567fc26f64_JaffaCakes118
Size 398KB
Sample240407-hmbb4sfd2v
SHA256 98ca248a6e8f0213a4c2dd31c78773832cff4a8383cc26cf428b62222a79ec3d
MD5 e451535b3434b5d314f84b567fc26f64
SHA1 7b10e40ab5653117a3fef9743eb29c7199f1d738
SHA512 27421464c8bfb783e199aed9e7bd6dfcaf091a95500499cd465c0d40a27fa4df44518d3f95fd55113751fccfdfe66eaaf3535a7acfaf6063c1b247fd4e8ef27f
SSDEEP 6144:778VcnvuiIW3E4SFYycqJPjsw8Sm7yaGNLgu/Vh1SlAXfiMl7uUasA5q:778WvVNRry3BoSHdjX1SSP71PtSq
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e451535b3434b5d314f84b567fc26f64_JaffaCakes118

File Explorer

e451535b3434b5d314f84b567fc26f64_JaffaCakes118

.exe 398KB

e451535b3434b5d314f84b567fc26f64_JaffaCakes118

IMPHASH 0b2bb4f9684df473a7d01f4d396fc8c2
SHA256 98ca248a6e8f0213a4c2dd31c78773832cff4a8383cc26cf428b62222a79ec3d
MD5 e451535b3434b5d314f84b567fc26f64
SHA1 7b10e40ab5653117a3fef9743eb29c7199f1d738
SHA512 27421464c8bfb783e199aed9e7bd6dfcaf091a95500499cd465c0d40a27fa4df44518d3f95fd55113751fccfdfe66eaaf3535a7acfaf6063c1b247fd4e8ef27f
SSDEEP 6144:778VcnvuiIW3E4SFYycqJPjsw8Sm7yaGNLgu/Vh1SlAXfiMl7uUasA5q:778WvVNRry3BoSHdjX1SSP71PtSq
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

841720

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

61KB

Virtual Size

475KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vmp0

Size

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

335KB

Virtual Size

334KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

76B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

e451535b3434b5d314f84b567fc26f64_JaffaCakes118

kernel32

user32

generic

Sharing

General

Malware Config

Signatures

File Explorer

e451535b3434b5d314f84b567fc26f64_JaffaCakes118

kernel32

user32

generic