f97d785dd49c9d508d494cbca1b4530c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f97d785dd49c9d508d494cbca1b4530c_JaffaCakes118
Size

128KB
MD5

f97d785dd49c9d508d494cbca1b4530c
SHA1

41ffbd7c1e01d351c31000528cdfc50e0206e87e
SHA256

c373efac6f4edf781b874c4dc10a360055a0026b7ddad32d381131e7aacaa624
SHA512

6349a2257a9bbbe65cd2008faaa1b3666f08ba2c639c6eeaa209eb8fba3d3af414d1999ac2241536d6c2c4ec97e1bdee49d9c740ddcb57902796f74e68e2aa9f
SSDEEP

3072:9c0kM13s9U5Vkrjw4BVCjspSCplZjqxDuXHbI:XdFs2Vkrjw4BVI2SEvwcI

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f97d785dd49c9d508d494cbca1b4530c_JaffaCakes118

Files

f97d785dd49c9d508d494cbca1b4530c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

cc88753b8a2b3cd002e05bd38b68573d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

MethCallEngine

kernel32

LoadLibraryA
VirtualProtect
GetModuleFileNameA

user32

MessageBoxA

Sections

.text
Size: - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 84KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 104KB - Virtual size: 101KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 108B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ