06f27113c5d459b82a2b8e5b95188657_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

06f27113c5d459b82a2b8e5b95188657_JaffaCakes118
Size

884KB
MD5

06f27113c5d459b82a2b8e5b95188657
SHA1

d59478da527f5d6ef873bc6f611e1a745c4c54a8
SHA256

d52da4bd51ac2cdcd17904df660d9ee96568f79e5583d50a927ab01c54a02ab3
SHA512

8ddb7805786cc6ff5c52e69070c3d2e685953f7375ab0ff5d96256a8e4f41063857902b25408f2bce7144d41d33e794e2166a272d9d9b8836102cfacbaa1701f
SSDEEP

24576:QIKDO1O9bSr7ACQmn+i8ygkDZuvyXnPEAu/8W:NXU9+AVm+byVDZuUnPP3W

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
06f27113c5d459b82a2b8e5b95188657_JaffaCakes118

Files

06f27113c5d459b82a2b8e5b95188657_JaffaCakes118
.dll windows:4 windows x86 arch:x86

6aceb42c86faf9d614a4165fe9635f67

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetStringTypeW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

RegisterClipboardFormatA

gdi32

SetStretchBltMode

winmm

midiStreamProperty

winspool.drv

OpenPrinterA

advapi32

RegQueryValueA

shell32

ShellExecuteA

ole32

OleInitialize

oleaut32

RegisterTypeLi

comctl32

ImageList_Destroy

ws2_32

inet_ntoa

comdlg32

ChooseColorA

Exports

Exports

????
RunDllHostCallBack

Sections

.text
Size: - Virtual size: 477KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 141KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 133KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: - Virtual size: 478KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp2
Size: 868KB - Virtual size: 865KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6aceb42c86faf9d614a4165fe9635f67

Headers

File Characteristics

Imports

kernel32

user32

gdi32

winmm

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

ws2_32

comdlg32

Exports

Exports

Sections

.text Size: - Virtual size: 477KB

.rdata Size: - Virtual size: 141KB

.data Size: - Virtual size: 133KB

.rsrc Size: 8KB - Virtual size: 21KB

.vmp0 Size: - Virtual size: 64KB

.vmp1 Size: - Virtual size: 478KB

.vmp2 Size: 868KB - Virtual size: 865KB

.reloc Size: 4KB - Virtual size: 120B

.text
Size: - Virtual size: 477KB

.rdata
Size: - Virtual size: 141KB

.data
Size: - Virtual size: 133KB

.rsrc
Size: 8KB - Virtual size: 21KB

.vmp0
Size: - Virtual size: 64KB

.vmp1
Size: - Virtual size: 478KB

.vmp2
Size: 868KB - Virtual size: 865KB

.reloc
Size: 4KB - Virtual size: 120B