Behavioral task
behavioral1
Sample
e97c96d8294d324ff80be16d0cf9aafa_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e97c96d8294d324ff80be16d0cf9aafa_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
e97c96d8294d324ff80be16d0cf9aafa_JaffaCakes118
-
Size
1.2MB
-
MD5
e97c96d8294d324ff80be16d0cf9aafa
-
SHA1
4a27b039f325896e7c1901cd46cc4859ac2f15f3
-
SHA256
96b790005ad2d23f5e64b06593dba78d3bc93403848e52a61e3c917bb0190ca0
-
SHA512
d3828d5b9d3a701232ea4ce83ce572da3a1939c7e69046bc3c9abb456365a46ab2cf5837cd3f697029d721707991093da24db54f470a2d51ce4742ae031ba90e
-
SSDEEP
24576:nhoCzJzwbUIFgDSwAzD+bj/TA3uRiCKDLC4ZhSePzgUlBiMbmd:hoCd7IFqAPwjsuRinDO4ZhB3lBiwE
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e97c96d8294d324ff80be16d0cf9aafa_JaffaCakes118
Files
-
e97c96d8294d324ff80be16d0cf9aafa_JaffaCakes118.exe windows:4 windows x86 arch:x86
222146aed92dd933fa724a51d29dd751
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaFreeObjList
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Sections
.text Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 88KB - Virtual size: 85KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp1 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE