Behavioral task
behavioral1
Sample
b73afbae7b6cc13e09fd2e9aadcee5d5_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
b73afbae7b6cc13e09fd2e9aadcee5d5_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
b73afbae7b6cc13e09fd2e9aadcee5d5_JaffaCakes118
-
Size
2.0MB
-
MD5
b73afbae7b6cc13e09fd2e9aadcee5d5
-
SHA1
f50af24c0b143c446ab58b4b2ffec122c3cca285
-
SHA256
22ca43204758ef6c999824d03d6a7fae144e7a040a4b644e367c05fa13f1883e
-
SHA512
af3a1264b81ca51218b16f01647f94d3499203ba51a27a20175c0a3608a88ca9a4c49dc66fc0a71955cfcc6e9265aaf7da1fb45c95af493b8be2b478b45356f5
-
SSDEEP
49152:yY3rU1IYBECvdjrUPld0jP4NHU3Oe+Cjldx5R3YK:yQiIGtWlujR3ZRj/xX3T
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b73afbae7b6cc13e09fd2e9aadcee5d5_JaffaCakes118
Files
-
b73afbae7b6cc13e09fd2e9aadcee5d5_JaffaCakes118.exe windows:5 windows x64 arch:x64
4c9677465efc367e08cbb6e0d5347a8d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
wsock32
recvfrom
version
GetFileVersionInfoSizeW
winmm
timeGetTime
comctl32
ImageList_ReplaceIcon
mpr
WNetUseConnectionW
wininet
InternetOpenW
psapi
GetProcessMemoryInfo
iphlpapi
IcmpCreateFile
userenv
UnloadUserProfile
uxtheme
IsThemeActive
kernel32
GetVersionExW
FlsAlloc
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
DefDlgProcW
gdi32
ExtCreatePen
comdlg32
GetOpenFileNameW
advapi32
RegConnectRegistryW
shell32
SHGetDesktopFolder
ole32
GetRunningObjectTable
oleaut32
SafeArrayUnaccessData
Sections
.text Size: - Virtual size: 672KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 190KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ