Behavioral task
behavioral1
Sample
64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
64119aa0b6a3110f625b073170593df6_JaffaCakes118
-
Size
488KB
-
MD5
64119aa0b6a3110f625b073170593df6
-
SHA1
5b22347aaa18af722aac5c7a3484b96542240497
-
SHA256
270cbd6409f932367cc6953dce42d9aee89f66d722a4cf6196cadf7401217937
-
SHA512
8f19eab7becf113f297c373ad9a79f9987913851dd2cb5fd5d2b3698c4d1ddd5123e212abf7c5344a9362a35979b9356c390b07f8d3f2ad0148b4f93f6f320be
-
SSDEEP
12288:5auUsBJJ7qeBAU/HKPrpE4wcsQoqurCMu:kuUeJ7qPU/HqlfwcsQ2mM
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 64119aa0b6a3110f625b073170593df6_JaffaCakes118
Files
-
64119aa0b6a3110f625b073170593df6_JaffaCakes118.exe windows:4 windows x86 arch:x86
ce472f9e68ef8e03ad4a9ee03c8581c3
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasGetConnectStatusA
kernel32
SetLastError
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
DispatchMessageA
MessageBoxA
gdi32
CreateBitmap
wsock32
gethostbyname
wininet
InternetOpenUrlA
advapi32
LsaOpenPolicy
shell32
ShellExecuteA
ole32
CoRevokeClassObject
winmm
timeSetEvent
shlwapi
PathFileExistsA
atl
ord47
dbghelp
MakeSureDirectoryPathExists
gdiplus
GdipCreateBitmapFromStream
oledlg
ord8
oleaut32
LHashValOfNameSys
winspool.drv
OpenPrinterA
comctl32
ord17
Sections
.text Size: - Virtual size: 576KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 330KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 163KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 480KB - Virtual size: 476KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ