Behavioral task
behavioral1
Sample
0cbb6dc7cd269224ccbe788fd523808c_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
0cbb6dc7cd269224ccbe788fd523808c_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
0cbb6dc7cd269224ccbe788fd523808c_JaffaCakes118
-
Size
574KB
-
MD5
0cbb6dc7cd269224ccbe788fd523808c
-
SHA1
6da09efe4b7da58ab9aff878750b37f3940df906
-
SHA256
0a71674030de0e7138b26a09682a9ec4f79d920795eba8e622c36d2f0380e8d2
-
SHA512
7e72375b336a6179ff7fc79173e8e70093a69df8c41b240cddc214f50b64e386205cccb47b312d44190df1b1675126434b352c44487feb989ba012a5d0fea248
-
SSDEEP
12288:Ml0lpy4yinF8Xy03S5Q0eBot8gqHLP88a5ydf6kPvHx1dlwYJDI:0Is4x30C5Q0V8zjtgyDPjt
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0cbb6dc7cd269224ccbe788fd523808c_JaffaCakes118
Files
-
0cbb6dc7cd269224ccbe788fd523808c_JaffaCakes118.exe windows:5 windows x86 arch:x86
3a542742d6727d46b6eda5c173013e3d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
GetModuleHandleA
GetProcAddress
VirtualProtect
advapi32
FreeSid
gdi32
GetDeviceCaps
user32
ExitWindowsEx
MessageBoxA
comctl32
ord17
version
GetFileVersionInfoA
oleaut32
VariantChangeTypeEx
Sections
Size: - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 152KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 328KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 568KB - Virtual size: 567KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 60B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ