Behavioral task
behavioral1
Sample
fcfde8e0b1f5634b558b8bf71cb948a4_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
fcfde8e0b1f5634b558b8bf71cb948a4_JaffaCakes118
-
Size
617KB
-
MD5
fcfde8e0b1f5634b558b8bf71cb948a4
-
SHA1
82f74439702e12b60116ecc2e4bd08253763711b
-
SHA256
0eb7d4a3f23629745a0fcd2ce654d2df95cc3c67d9c1b0d241aefb4e6dca8b68
-
SHA512
f642ecdd99b104035779788cc7a14591ad4c9a66d69a91ea9dfbdf9a55bb6f4e0b73cc7cccee86e7b2e45203fc2a0c0cc600d3272cd71af8f20e40396c18429a
-
SSDEEP
12288:8Hyisj4wbS4LwFMIYse+79s+oSn1utWCSXrJ:8HL3OwS2pMSn1mRs
Malware Config
Signatures
-
resource yara_rule sample upx -
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fcfde8e0b1f5634b558b8bf71cb948a4_JaffaCakes118
Files
-
fcfde8e0b1f5634b558b8bf71cb948a4_JaffaCakes118.exe windows:4 windows x86 arch:x86
6e774f52758ecc5b3e9b58ccec567f7a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
advapi32
RegCloseKey
comctl32
ord17
comdlg32
ChooseColorA
gdi32
EndDoc
ole32
OleRun
oleaut32
RegisterTypeLi
rasapi32
RasHangUpA
shell32
DragFinish
user32
GetDC
MessageBoxA
wininet
InternetCloseHandle
winmm
waveOutOpen
winspool.drv
OpenPrinterA
ws2_32
closesocket
Sections
UPX0 Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: - Virtual size: 348KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 189KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 426KB - Virtual size: 426KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 168B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ