aa164214ff5f6af2f4e28b6aa6d25e1b_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

aa164214ff5f6af2f4e28b6aa6d25e1b_JaffaCakes118
Size

5.8MB
MD5

aa164214ff5f6af2f4e28b6aa6d25e1b
SHA1

7da12991c2c96006baaaf6fd0fed7e3ee7aa91e0
SHA256

67118bd39edf4136eea323c53d9381ffb2878c4d1fe875c8a969f820d07d79a6
SHA512

b20f5aa114c8c972e7465de2c659fa30aabeb307806cc4517101a0f7b6ac7be9e4a33217f3b80c02b6f7d121f897deb3a97987eea6527e1e92d4b884dcce6490
SSDEEP

98304:NMp5EBCoIyyx2JJDNC/LyBC2/54F4AWUi91BiQzFuoUINnfK170otkKZkLScOFjT:NMpSBCoIbx27DNC+54Fhy1Lzopua70W+

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aa164214ff5f6af2f4e28b6aa6d25e1b_JaffaCakes118

Files

aa164214ff5f6af2f4e28b6aa6d25e1b_JaffaCakes118
.exe windows:5 windows x64 arch:x64

a08a23bfb67acb10b0fe83223baee4e4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

wsock32

gethostbyname

winmm

mixerGetLineInfoW

version

GetFileVersionInfoW

comctl32

ImageList_Create

psapi

GetModuleFileNameExW

wininet

InternetOpenW

kernel32

GetVersionExW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

GetMenuItemCount
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW

gdi32

GetPixel

comdlg32

CommDlgExtendedError

advapi32

RegDeleteKeyW

shell32

DragQueryPoint

ole32

OleInitialize

oleaut32

SafeArrayGetLBound

wtsapi32

WTSSendMessageW

Sections

.text
Size: - Virtual size: 788KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 228KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: - Virtual size: 228B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 3.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 5.8MB - Virtual size: 5.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a08a23bfb67acb10b0fe83223baee4e4

Headers

DLL Characteristics

File Characteristics

Imports

wsock32

winmm

version

comctl32

psapi

wininet

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

wtsapi32

Sections

.text Size: - Virtual size: 788KB

.rdata Size: - Virtual size: 228KB

.data Size: - Virtual size: 39KB

.pdata Size: - Virtual size: 28KB

.gfids Size: - Virtual size: 228B

.vmp0 Size: - Virtual size: 3.8MB

.vmp1 Size: 5.8MB - Virtual size: 5.8MB

.rsrc Size: 21KB - Virtual size: 20KB

.text
Size: - Virtual size: 788KB

.rdata
Size: - Virtual size: 228KB

.data
Size: - Virtual size: 39KB

.pdata
Size: - Virtual size: 28KB

.gfids
Size: - Virtual size: 228B

.vmp0
Size: - Virtual size: 3.8MB

.vmp1
Size: 5.8MB - Virtual size: 5.8MB

.rsrc
Size: 21KB - Virtual size: 20KB