Behavioral task
behavioral1
Sample
f6982fd42e6b8762a5ea0b783692cd4b_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
f6982fd42e6b8762a5ea0b783692cd4b_JaffaCakes118
-
Size
1.4MB
-
MD5
f6982fd42e6b8762a5ea0b783692cd4b
-
SHA1
bf8466198ac506ed7810d308d3e463ab20ef9303
-
SHA256
391412d5e4d7f25afb1c1e93c720c46db0baee44a18d0d9f0dad58975de9d976
-
SHA512
d29c4dd5e0c58f764d525d99dcf31b45009c9d1318dc60f7a9c4daffc3fa869d8fb44033676155c7bd71f82878a64b1cbf6113464bed68a3b8c71ec471f61baf
-
SSDEEP
24576:ub3M58Fz0tLBzuwD1D/vOSeASVrcdNTIRsLCSpL0UQmrD+Y792lipqj33t1siewo:07WtBuyrOjAyaN5LhpL0UQeDz792ljzq
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f6982fd42e6b8762a5ea0b783692cd4b_JaffaCakes118
Files
-
f6982fd42e6b8762a5ea0b783692cd4b_JaffaCakes118.exe windows:4 windows x86 arch:x86
3775e587745349c5043fec850b00df9f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
EnableWindow
MessageBoxA
gdi32
GetViewportExtEx
winmm
midiStreamOpen
winspool.drv
DocumentPropertiesA
advapi32
RegQueryValueExA
shell32
Shell_NotifyIconA
ole32
OleUninitialize
oleaut32
VariantCopyInd
comctl32
ImageList_Destroy
ws2_32
recvfrom
comdlg32
GetFileTitleA
Sections
.text Size: - Virtual size: 470KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 775KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 133KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 116KB - Virtual size: 129KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 292KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp1 Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE