Behavioral task
behavioral1
Sample
52f4cc475bb2d26643911e24a0fbcd2e_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
52f4cc475bb2d26643911e24a0fbcd2e_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
52f4cc475bb2d26643911e24a0fbcd2e_JaffaCakes118
-
Size
144KB
-
MD5
52f4cc475bb2d26643911e24a0fbcd2e
-
SHA1
daa56e8f913a0e7fd100b9352bc493185b836205
-
SHA256
33b840aad4985d882b0c3f693b2f809b6f90f3ad5824db70f8721ade9befe1f2
-
SHA512
6f75fdd9c471f7287d8a8d62944c5b6e6f7458b3309b12b5062240d45bb3cbd40512f3c48b1dc0e0b8c12f9929daa69e5c6f1d67cf36dfbafd99ef25f6cf2e24
-
SSDEEP
3072:jCsYL2yBf6l7T93e4qht2Axc1ejihAyuRfGo3J5db5l:fhyae4St2w7OZ+/Xr
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 52f4cc475bb2d26643911e24a0fbcd2e_JaffaCakes118
Files
-
52f4cc475bb2d26643911e24a0fbcd2e_JaffaCakes118.exe windows:4 windows x86 arch:x86
4abf8612476f29932e632407f957beb3
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord1776
msvcrt
__set_app_type
kernel32
CloseHandle
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
wsprintfA
MessageBoxA
Sections
.text Size: - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 58KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 132KB - Virtual size: 130KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 188B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ