Behavioral task
behavioral1
Sample
f81495ed85e93d6015d930a910d059a8_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
f81495ed85e93d6015d930a910d059a8_JaffaCakes118
-
Size
1.8MB
-
MD5
f81495ed85e93d6015d930a910d059a8
-
SHA1
806f0cd1f924d82a906aad65e7b5baaddbb9d94a
-
SHA256
ccef042bc9897a81595201e9565497a8aa2a043dd0ce015e964db9c20f277686
-
SHA512
d30898b635b8e5e5fc3449715c8f9cc22affefe7ae9a3b98bc887fe170755c286130e38b92e37b0a8c1bd258bbc9fdcfbd4d69df981b2f7e4936584d02430832
-
SSDEEP
49152:gCiQB60x95JXrxJrxiZREXZq23vFgyLnkgVDSowq7M:gCjprbXVJrxiZWq2tgylVw
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f81495ed85e93d6015d930a910d059a8_JaffaCakes118
Files
-
f81495ed85e93d6015d930a910d059a8_JaffaCakes118.exe windows:5 windows x86 arch:x86
fab092869481c450bd9e3cad06eab690
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamClose
ws2_32
send
msvfw32
DrawDibDraw
avifil32
AVIStreamInfoA
rasapi32
RasGetConnectStatusA
kernel32
GlobalReAlloc
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
UnregisterClassA
gdi32
SetROP2
winspool.drv
ClosePrinter
comdlg32
ChooseFontA
advapi32
RegCloseKey
shell32
ShellExecuteA
ole32
CLSIDFromProgID
oleaut32
SafeArrayCreate
comctl32
ImageList_SetBkColor
oledlg
ord8
wininet
InternetCloseHandle
Sections
.text Size: - Virtual size: 908KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 438KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 482KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ