Behavioral task
behavioral1
Sample
297155e2ea6ee2734f3a3fc6492b9a2e_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
297155e2ea6ee2734f3a3fc6492b9a2e_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
297155e2ea6ee2734f3a3fc6492b9a2e_JaffaCakes118
-
Size
1.9MB
-
MD5
297155e2ea6ee2734f3a3fc6492b9a2e
-
SHA1
63bb99c6fe8cdca5e4afb85953834a43f384eb16
-
SHA256
63c04f26a283a3118c5cd02ce143969feb562063f68659627f6ec65461ae510d
-
SHA512
7da2ae68a7fef458c6e5a94864b08b0de4008e18957be8998f83ac2db12e494fe8e2286e30af4c5f5d3846b3c0193fc185bdd20d70ffb8f529abde2dc68b76db
-
SSDEEP
49152:waMEmDQlcmuNjmoXKV0HmfnfclJ4fTbjbFM+H:waMEmyEZ1Xg0e8J43j51
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 297155e2ea6ee2734f3a3fc6492b9a2e_JaffaCakes118
Files
-
297155e2ea6ee2734f3a3fc6492b9a2e_JaffaCakes118.exe windows:5 windows x64 arch:x64
35bf3af4d1ecde7fdc0c239ef19966b8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
wsock32
WSAStartup
version
GetFileVersionInfoW
winmm
waveOutSetVolume
comctl32
InitCommonControlsEx
mpr
WNetUseConnectionW
wininet
InternetQueryDataAvailable
psapi
GetProcessMemoryInfo
iphlpapi
IcmpCreateFile
userenv
DestroyEnvironmentBlock
uxtheme
IsThemeActive
kernel32
GetVersionExW
FindResourceExA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetKeyboardLayoutNameW
gdi32
CreateCompatibleDC
comdlg32
GetOpenFileNameW
advapi32
InitiateSystemShutdownExW
shell32
ShellExecuteExW
ole32
CoInitialize
oleaut32
SafeArrayUnaccessData
Sections
.text Size: - Virtual size: 672KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 190KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ