Behavioral task
behavioral1
Sample
0b9333c62ae0cdf2ae509a787834356a_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0b9333c62ae0cdf2ae509a787834356a_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
0b9333c62ae0cdf2ae509a787834356a_JaffaCakes118
-
Size
1.1MB
-
MD5
0b9333c62ae0cdf2ae509a787834356a
-
SHA1
99fc418d3e205d1659dcabba3f30f4bc180a5b76
-
SHA256
41a3d62f328ad721234cd56f26966fff94f28ba5ced8b2d87ce00a8dc79a00db
-
SHA512
abd116405125d137583bdd1312ff5d468eec3581a12609f844e694c58f3b1b83e8b1a1f71e9ac511b0ad0a30f90551ee210be93c553151a75749c159830d2fd2
-
SSDEEP
24576:JnshRrPZs1m/8/nM7xSJ9VpjK0WVBvD2Jtf3uMLW:6RuuMn/LpjKtV1e
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0b9333c62ae0cdf2ae509a787834356a_JaffaCakes118
Files
-
0b9333c62ae0cdf2ae509a787834356a_JaffaCakes118.exe windows:4 windows x86 arch:x86
c85a96388d27169cb9f0d21c47cd3112
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
wininet
InternetSetOptionA
mfc42
ord2817
msvcrt
_strnicmp
kernel32
GetCurrentThread
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
GetClientRect
MessageBoxA
ole32
CoInitialize
msvcp60
??1_Lockit@std@@QAE@XZ
shlwapi
SHDeleteKeyA
gdi32
Escape
advapi32
CreateServiceA
shell32
ShellExecuteA
comctl32
ImageList_GetImageInfo
oleaut32
SysFreeString
winmm
timeGetTime
Sections
.text Size: - Virtual size: 344KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 196KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 718KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 196B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ