e94755ee3c0ec04a6ee01000697b441e_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

e94755ee3c0ec04a6ee01000697b441e_JaffaCakes118
Size

3.0MB
MD5

e94755ee3c0ec04a6ee01000697b441e
SHA1

4bf4484a35000188a44af41093d11b60d64000b7
SHA256

0ad87e17cea59e3852731aab5b83c05032b2f32c99a1c9eabff0f299c4b9368c
SHA512

2423ee75781768397c0a096d05f2f053ad7fc2869f3c0b86fb71bbd74fa03a6ebd255d9e8b3bb65f7b71882da4843e3c454498c05ab372e86d1ed974fa19f85c
SSDEEP

49152:Dd1dKwGWQcyLY2DPiIflWlMSDrkgN/P0B9/KfKiChwp57bmqg67sEZID/2RYLp2j:BLDTQtjqAIjrnPiyKdu+qBlkEFQSr

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e94755ee3c0ec04a6ee01000697b441e_JaffaCakes118

Files

e94755ee3c0ec04a6ee01000697b441e_JaffaCakes118
.exe windows:6 windows x86 arch:x86

4df819e34e543b560ab910e869d8033d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateFileA
GetFileSize
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
WriteFile
GetModuleFileNameA
GetTickCount
GetModuleHandleW
VirtualAllocEx
WriteProcessMemory
VirtualFreeEx
CreateRemoteThread
WaitForSingleObject
CreateProcessA
GetWindowsDirectoryA
QueryPerformanceCounter
GetNativeSystemInfo
GetLastError
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
CreateThread
TerminateThread
GetCurrentDirectoryA
GetProcessTimes
GetFileAttributesA
GetTempPathA
GetCommandLineA
GetCurrentThread
GetCurrentThreadId
TerminateProcess
FindResourceA
LoadResource
SizeofResource
LockResource
FreeResource
SetLastError
UnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetCurrentProcess
GetModuleHandleA
VirtualFree
VirtualProtect
VirtualAlloc
GetSystemInfo
SetUnhandledExceptionFilter
CloseHandle
ReadProcessMemory
OpenProcess
GetCurrentProcessId
IsDebuggerPresent
GetVersionExA
FreeLibrary
GetProcAddress
LoadLibraryA
ExitProcess
GetModuleHandleExW
IsWow64Process
GetTickCount64
Sleep
WideCharToMultiByte
MultiByteToWideChar
GetProcessHeap
HeapAlloc
HeapFree
InitializeSListHead
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

EnumWindows
GetWindowThreadProcessId
IsWindowVisible
GetClassNameA
ShowWindow
GetWindowTextA
IsWindow

advapi32

RegCloseKey
OpenSCManagerA
OpenThreadToken
AdjustTokenPrivileges
LookupPrivilegeValueA
RegOpenKeyA
OpenProcessToken
CreateProcessAsUserA
RegEnumKeyExA
RegQueryInfoKeyA
RegQueryValueExA
RegOpenKeyExA
CloseServiceHandle
EnumServicesStatusA

ole32

CoUninitialize
CoSetProxyBlanket
CoCreateInstance
CoInitialize

oleaut32

VariantClear
VariantInit
SysFreeString
SysAllocString

iphlpapi

GetAdaptersInfo

ws2_32

closesocket
shutdown
send
__WSAFDIsSet
select
connect
ioctlsocket
setsockopt
socket
htons
WSAGetLastError
WSAStartup
gethostname
gethostbyname
inet_ntoa
WSACleanup
inet_addr
recv

shlwapi

PathIsDirectoryA

msvcrt

strncpy
strchr
atoi
strtoul
fflush
wcscpy_s
strncmp
srand
strcat_s
_mbsicmp
_mbsstr
strrchr
_errno
_time64
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
_CxxThrowException
__setusermatherr
_initterm
_initterm_e
_set_fmode
__p__commode
_amsg_exit
_except_handler4_common
__getmainargs
memset
_controlfp_s
_stricmp
fclose
memcpy
__pctype_func
_iob
strcpy_s
_lock
_unlock
_msize
__set_app_type
_ismbblead
_acmdln
abort
_isatty
_fileno
_XcptFilter
?terminate@@YAXXZ
realloc
fopen
_mbsrchr
rand
memchr
strstr
free
malloc
??_V@YAXPAX@Z
??_U@YAPAXI@Z
_except_handler3
memmove
??2@YAPAXI@Z
??3@YAXPAX@Z
fwrite
tolower
strtol
wctomb_s
wcsnlen
strnlen
localeconv
_CIlog10
_ftol2_sse
ceil
_clearfp
__CxxFrameHandler3
memcmp

Exports

Exports

DllProc

Sections

.text
Size: - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rtmd0
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 3.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4df819e34e543b560ab910e869d8033d

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

oleaut32

iphlpapi

ws2_32

shlwapi

msvcrt

Exports

Exports

Sections

.text Size: - Virtual size: 70KB

.rdata Size: - Virtual size: 30KB

.data Size: - Virtual size: 4KB

.gfids Size: - Virtual size: 28B

.tls Size: 512B - Virtual size: 9B

.rtmd0 Size: - Virtual size: 8KB

.vmp0 Size: - Virtual size: 12KB

.vmp1 Size: 3.0MB - Virtual size: 3.0MB

.reloc Size: 512B - Virtual size: 176B

.rsrc Size: 1024B - Virtual size: 3.2MB

.text
Size: - Virtual size: 70KB

.rdata
Size: - Virtual size: 30KB

.data
Size: - Virtual size: 4KB

.gfids
Size: - Virtual size: 28B

.tls
Size: 512B - Virtual size: 9B

.rtmd0
Size: - Virtual size: 8KB

.vmp0
Size: - Virtual size: 12KB

.vmp1
Size: 3.0MB - Virtual size: 3.0MB

.reloc
Size: 512B - Virtual size: 176B

.rsrc
Size: 1024B - Virtual size: 3.2MB