14de515a094eb8261ee2819391b2f539_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

14de515a094eb8261ee2819391b2f539_JaffaCakes118
Size

3.3MB
MD5

14de515a094eb8261ee2819391b2f539
SHA1

d21fb5d81710c2e4a5b41a47ffd8611da872dfdf
SHA256

9e892e9c15afe822c0c236d8472445110c8bd909dbc8a4f81b308d623fd8fa20
SHA512

4b81d2425af49c15ba822bf37c3ac765f20bc9df58a4e644fb143218ccd211a5b32273ea7bd3084b6ed93859182b1e86bb5876bef12f4e2167513ac3cdd9333a
SSDEEP

98304:1PEoX9PaN7cZdCvPaSkm4ZL8BtXeNvBZs2xNFS1a:REoNPoeCvPkmTeNZyyE1a

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
14de515a094eb8261ee2819391b2f539_JaffaCakes118

Files

14de515a094eb8261ee2819391b2f539_JaffaCakes118
.exe windows:6 windows x86 arch:x86

618770208644f72a4766d4bb3d37f913

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSASetLastError
send
WSAGetLastError
WSAIoctl
WSAStartup
WSACleanup
accept
htonl
listen
ioctlsocket
__WSAFDIsSet
getaddrinfo
freeaddrinfo
recvfrom
sendto
gethostname
ntohl
recv
socket
select
bind
connect
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
closesocket

crypt32

CertFindExtension
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFreeCertificateContext
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore

wldap32

ord143
ord301
ord200
ord30
ord79
ord35
ord33
ord32
ord217
ord27
ord26
ord22
ord41
ord50
ord45
ord60
ord211
ord46

normaliz

IdnToAscii

kernel32

QueryPerformanceCounter
VerifyVersionInfoA
MoveFileExA
CloseHandle
WaitForSingleObjectEx
MultiByteToWideChar
GetCurrentProcess
GetEnvironmentVariableA
GetStdHandle
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
SetLastError
FormatMessageA
CreateFileA
GetFileSizeEx
WideCharToMultiByte
GetTickCount
LoadLibraryA
GetProcAddress
GetModuleHandleA
FreeLibrary
GetSystemDirectoryA
QueryPerformanceFrequency
VerSetConditionMask
GetModuleHandleW
SleepEx
GetLastError
DeleteCriticalSection
InitializeCriticalSectionEx
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
SetUnhandledExceptionFilter
GetModuleFileNameA
Process32First
CreateToolhelp32Snapshot
Sleep
CopyFileA
Process32Next
ExitProcess
EnterCriticalSection
LeaveCriticalSection
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

advapi32

CryptAcquireContextA
CryptGetHashParam
CryptGenRandom
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptEncrypt
CryptReleaseContext

shell32

ShellExecuteA

msvcp140

_Strxfrm
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Xbad_alloc@std@@YAXXZ
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?id@?$ctype@D@std@@2V0locale@2@A
?_Xlength_error@std@@YAXPBD@Z
?id@?$collate@D@std@@2V0locale@2@A
_Strcoll
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?tolower@?$ctype@D@std@@QBEPBDPADPBD@Z
?tolower@?$ctype@D@std@@QBEDD@Z
??1facet@locale@std@@MAE@XZ
??0facet@locale@std@@IAE@I@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UAEXXZ
??Bid@locale@std@@QAEIXZ
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
??1_Locinfo@std@@QAE@XZ
??0_Locinfo@std@@QAE@PBD@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ

urlmon

URLDownloadToFileA

vcruntime140

memchr
strstr
__current_exception
__current_exception_context
_CxxThrowException
memmove
strrchr
memcpy
memset
strchr
__std_terminate
__std_exception_copy
__std_exception_destroy
__CxxFrameHandler3
_except_handler4_common

api-ms-win-crt-heap-l1-1-0

calloc
free
_callnewh
realloc
malloc
_set_new_mode

api-ms-win-crt-filesystem-l1-1-0

_unlink
_access
_stat64i32
_mkdir
_fstat64
_stat64

api-ms-win-crt-stdio-l1-1-0

fread
_set_fmode
_lseeki64
fgets
__stdio_common_vsprintf
fputc
fflush
_getcwd
ftell
__acrt_iob_func
feof
__stdio_common_vsscanf
fputs
_read
_write
_close
_open
fopen
fclose
fwrite
__p__commode
fseek

api-ms-win-crt-runtime-l1-1-0

terminate
_beginthreadex
_initialize_onexit_table
_register_onexit_function
_controlfp_s
_getpid
_invalid_parameter_noinfo_noreturn
_errno
__sys_nerr
_crt_atexit
_set_app_type
__p___argc
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_initterm_e
exit
_exit
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_seh_filter_exe
strerror

api-ms-win-crt-string-l1-1-0

strncpy
strncmp
_strdup
isupper
strspn
strcspn
tolower
strpbrk

api-ms-win-crt-time-l1-1-0

_time64
_gmtime64

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-convert-l1-1-0

strtoll
strtol
atoi
strtoul

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

user32

GetProcessWindowStation
GetUserObjectInformationW

Sections

.text
Size: - Virtual size: 330KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 3.3MB - Virtual size: 3.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 469B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

618770208644f72a4766d4bb3d37f913

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

crypt32

wldap32

normaliz

kernel32

advapi32

shell32

msvcp140

urlmon

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

user32

Sections

.text Size: - Virtual size: 330KB

.rdata Size: - Virtual size: 59KB

.data Size: - Virtual size: 2KB

.vmp0 Size: - Virtual size: 1.5MB

.vmp1 Size: 3.3MB - Virtual size: 3.3MB

.reloc Size: 1KB - Virtual size: 1KB

.rsrc Size: 512B - Virtual size: 469B

.text
Size: - Virtual size: 330KB

.rdata
Size: - Virtual size: 59KB

.data
Size: - Virtual size: 2KB

.vmp0
Size: - Virtual size: 1.5MB

.vmp1
Size: 3.3MB - Virtual size: 3.3MB

.reloc
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 469B