Behavioral task
behavioral1
Sample
f99e600cfe6c1a5f490e21241c787244_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f99e600cfe6c1a5f490e21241c787244_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
f99e600cfe6c1a5f490e21241c787244_JaffaCakes118
-
Size
1.6MB
-
MD5
f99e600cfe6c1a5f490e21241c787244
-
SHA1
71b7e87b9ef82d746ac007fc19bfcd4d81e7a188
-
SHA256
ddc835488cf3ee5a5e027a38e39b2d3489d9647a2784c5a837711364850491f3
-
SHA512
50ff7d0a39c4291fab344ec6c34018cf095cd54e026eb700decdbae094bceeb3167272daa69ec7fbf9793befdbe00a8839a29741052bdb6734b7e42cb8cc7d73
-
SSDEEP
49152:rshFTpxtk0BqjUpOvEpP5nzSwNYHiPFoS/GPy7sF:Gtk0MjUpDpPzYHiNoSg
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f99e600cfe6c1a5f490e21241c787244_JaffaCakes118
Files
-
f99e600cfe6c1a5f490e21241c787244_JaffaCakes118.exe windows:4 windows x86 arch:x86
0fd57dc8da994cc927dd9cdecfd3c48a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapReAlloc
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetScrollRange
gdi32
SetROP2
winmm
waveOutGetNumDevs
winspool.drv
OpenPrinterA
advapi32
RegCreateKeyA
shell32
ShellExecuteA
ole32
CoRegisterMessageFilter
oleaut32
SafeArrayAccessData
comctl32
ord17
oledlg
ord8
ws2_32
bind
comdlg32
GetFileTitleA
Sections
.text Size: - Virtual size: 547KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 210KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 329KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp1 Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE