0432e85101b6628c72addae7d5c5aae9_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

0432e85101b6628c72addae7d5c5aae9_JaffaCakes118
Size

3.2MB
MD5

0432e85101b6628c72addae7d5c5aae9
SHA1

34bf4ea558a5d877a67b46a6427d5c85c7bb8ed3
SHA256

9df8b79786539bfdcfa44a8c6137dbca617594709a74172df9e7059ec0385a82
SHA512

407d855f907c874371e5aaf8cb80225d6c7d36ca01761803312b349ee9e3c4e321470f5bf4a6c21d0dcbae20953f82bcf60085264d7f2e6324eac37c88d26d90
SSDEEP

49152:Z1TEaP0I/iTLaOXhEdFsb2Z3wmU6dSklvy2ghOFBd:YG/icdFBw+628OZ

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0432e85101b6628c72addae7d5c5aae9_JaffaCakes118

Files

0432e85101b6628c72addae7d5c5aae9_JaffaCakes118
.exe windows:5 windows x86 arch:x86

154349ec50f6d2b516bbb08ef638ef71

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersionExW
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

ScreenToClient

gdi32

PtVisible

msimg32

AlphaBlend

comdlg32

GetOpenFileNameW

winspool.drv

DocumentPropertiesW

advapi32

ReportEventA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle

shell32

DragFinish

comctl32

InitCommonControlsEx

shlwapi

PathFindExtensionW

ole32

CreateStreamOnHGlobal

oleaut32

OleCreateFontIndirect

oledlg

OleUIBusyW

gdiplus

GdipCreateBitmapFromScan0

ws2_32

WSAEnumNetworkEvents

rasapi32

RasDialW

iphlpapi

GetAdaptersInfo

wininet

InternetCrackUrlW

winhttp

WinHttpCloseHandle

version

VerQueryValueW

oleacc

LresultFromObject

Exports

Exports

OSPX_edesc
OSPX_efunc
OSPX_error_register
OSPX_error_unregister
OSPX_errprefix
OSPX_errprefix_append
OSPX_errprefix_clr
OSPX_getlasterror
OSPX_gettimeofday
OSPX_library_end
OSPX_library_init
OSPX_pthread_cond_broadcast
OSPX_pthread_cond_destroy
OSPX_pthread_cond_init
OSPX_pthread_cond_signal
OSPX_pthread_cond_timedwait
OSPX_pthread_create
OSPX_pthread_detach
OSPX_pthread_join
OSPX_pthread_once
OSPX_pthread_rwlock_destroy
OSPX_pthread_rwlock_init
OSPX_pthread_rwlock_rdlock
OSPX_pthread_rwlock_tryrdlock
OSPX_pthread_rwlock_trywrlock
OSPX_pthread_rwlock_unlock
OSPX_pthread_rwlock_wrlock
OSPX_pthread_self
OSPX_sem_destroy
OSPX_sem_getvalue
OSPX_sem_init
OSPX_sem_post
OSPX_sem_timedwait
OSPX_sem_wait
OSPX_setlasterror
OSPX_setlasterror2
OSPX_strerror
OSPX_sys_strerror
stpool_add_routine
stpool_addref
stpool_adjust
stpool_adjust_abs
stpool_caps
stpool_create
stpool_create_byfac
stpool_desc
stpool_factory_list2
stpool_flush
stpool_mark_all
stpool_mark_cb
stpool_release
stpool_remove_all
stpool_resume
stpool_scheduler_map_dump2
stpool_set_activetimeo
stpool_stat
stpool_stat_print
stpool_stat_print2
stpool_strerror
stpool_suspend
stpool_task_clone
stpool_task_deinit
stpool_task_delete
stpool_task_detach
stpool_task_get_userflags
stpool_task_getschattr
stpool_task_init
stpool_task_is_free
stpool_task_mark
stpool_task_new
stpool_task_p
stpool_task_pname
stpool_task_pthrottle_wait
stpool_task_queue
stpool_task_remove
stpool_task_set_p
stpool_task_set_userflags
stpool_task_setschattr
stpool_task_size
stpool_task_stat
stpool_task_stat2
stpool_task_vm
stpool_task_wait
stpool_task_wait_all
stpool_task_wait_any
stpool_thread_getscheattr
stpool_thread_setscheattr
stpool_throttle_enable
stpool_throttle_wait
stpool_version
stpool_wait_all
stpool_wait_any
stpool_wait_cb
stpool_wakeid
stpool_wakeup

Sections

.text
Size: - Virtual size: 3.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 931KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 2.1MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 76KB - Virtual size: 452KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

154349ec50f6d2b516bbb08ef638ef71

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

oledlg

gdiplus

ws2_32

rasapi32

iphlpapi

wininet

winhttp

version

oleacc

Exports

Exports

Sections

.text Size: - Virtual size: 3.0MB

.rdata Size: 1.0MB - Virtual size: 1.0MB

.data Size: - Virtual size: 98KB

.vmp0 Size: - Virtual size: 931KB

.vmp1 Size: 2.1MB - Virtual size: 2.0MB

.rsrc Size: 76KB - Virtual size: 452KB

.text
Size: - Virtual size: 3.0MB

.rdata
Size: 1.0MB - Virtual size: 1.0MB

.data
Size: - Virtual size: 98KB

.vmp0
Size: - Virtual size: 931KB

.vmp1
Size: 2.1MB - Virtual size: 2.0MB

.rsrc
Size: 76KB - Virtual size: 452KB