077e30d2f96a368706f8c5f1ad645a58_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

077e30d2f96a368706f8c5f1ad645a58_JaffaCakes118
Size

111KB
MD5

077e30d2f96a368706f8c5f1ad645a58
SHA1

0dfc085f73fce86f14e9c61707ba85fcfba74310
SHA256

149694dc2243fe74cc88b104e578bb34f371c95553ad78a58902e2d37dc4f497
SHA512

1eec7fc7025f3d56fda5d209cfd7358fe48c32c1760de1a307895d53ac62fb9f0c7450226b32fc9fa56157e4af588cf1716606b99e0ab709a5abe151791c2e90
SSDEEP

3072:FF6BovaeuhWqhIUaiwsc3mzcxVfCm4a4kQHeSDhaC9dDVUy:FUBovYrWUaiwl36iVwa4kQHeSDhaCdDV

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
077e30d2f96a368706f8c5f1ad645a58_JaffaCakes118

Files

077e30d2f96a368706f8c5f1ad645a58_JaffaCakes118
.exe windows:4 windows x86 arch:x86

4c6c864c6c195a22ab44649d634cc910

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
WriteFile
GetLastError
CreateFileA
DeleteFileA
SizeofResource
LockResource
LoadResource
FindResourceA
FreeLibrary
GetProcAddress
LoadLibraryA
ExpandEnvironmentStringsA
GetTickCount
GetModuleHandleA
GetCommandLineA
VirtualProtect
GetModuleFileNameA
ExitProcess

mfc42

ord825
ord823
ord1168
ord561
ord815
ord1575

msvcrt

_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__p___initenv
exit
_XcptFilter
_exit
__dllonexit
??1type_info@@UAE@XZ
sprintf
tolower
_CxxThrowException
__CxxFrameHandler
_onexit

msvcp60

??1_Winit@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHIIPBDI@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
?_Xran@std@@YAXXZ
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?max_size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?_Xlen@std@@YAXXZ
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z

user32

MessageBoxA

Sections

.text
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 876B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 109KB - Virtual size: 109KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4c6c864c6c195a22ab44649d634cc910

Headers

File Characteristics

Imports

kernel32

mfc42

msvcrt

msvcp60

user32

Sections

.text Size: - Virtual size: 4KB

.rdata Size: - Virtual size: 2KB

.data Size: - Virtual size: 876B

.rsrc Size: 512B - Virtual size: 64KB

.vmp0 Size: - Virtual size: 11KB

.vmp1 Size: 109KB - Virtual size: 109KB

.reloc Size: 512B - Virtual size: 88B

.text
Size: - Virtual size: 4KB

.rdata
Size: - Virtual size: 2KB

.data
Size: - Virtual size: 876B

.rsrc
Size: 512B - Virtual size: 64KB

.vmp0
Size: - Virtual size: 11KB

.vmp1
Size: 109KB - Virtual size: 109KB

.reloc
Size: 512B - Virtual size: 88B