0e2c31a6111f28e5ee13624877cec29f_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0e2c31a6111f28e5ee13624877cec29f_JaffaCakes118
Size

48KB
MD5

0e2c31a6111f28e5ee13624877cec29f
SHA1

07ea4a676e24335a22caa8992e269044cad64665
SHA256

7d4151e812259a80cbb2f670ddda92b92489c117c75076298d367ace84d597e2
SHA512

f411042b7b259121d984bf83edcb690c864663465a7deb8bf79f626cfcc5fa84b960f943f6374a6fc080394c70b5f428e3b74bacc2371ecadaf096c31d52db39
SSDEEP

768:1bezlY1vwr8SkemjuGYddGski7ZaCvYiG42DQ116kW:FezlavwQSHmjuzddGsk4Tw/A1M

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0e2c31a6111f28e5ee13624877cec29f_JaffaCakes118

Files

0e2c31a6111f28e5ee13624877cec29f_JaffaCakes118
.dll windows:4 windows x86 arch:x86

5f968af5b04a6d574b54ebbfc7e68755

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

WSAStartup
htons
closesocket
send
inet_addr
socket
inet_ntoa
gethostbyname
recv
connect

shlwapi

StrStrIA

psapi

GetModuleFileNameExA

gdiplus

GdipAlloc
GdipFree
GdipGetImageEncoders
GdipGetImageEncodersSize
GdiplusStartup
GdipLoadImageFromFile
GdipDisposeImage
GdipCloneImage
GdipSaveImageToFile

mfc42

ord5300
ord5302
ord2725
ord4079
ord4698
ord5307
ord5289
ord5714
ord2982
ord3147
ord3259
ord3346
ord3136
ord3262
ord2985
ord3081
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord4622
ord4424
ord3738
ord561
ord825
ord815
ord3953
ord823
ord2396
ord5199
ord1089
ord3922
ord5731
ord2512
ord2554
ord4486
ord6375
ord4274
ord269
ord826
ord600
ord1578
ord6467
ord1255
ord1253
ord1570
ord1197
ord1243
ord1116
ord342
ord1182
ord1577
ord1168
ord1575
ord1176
ord4465

msvcrt

??1type_info@@UAE@XZ
_adjust_fdiv
_initterm
_onexit
__dllonexit
__CxxFrameHandler
strrchr
strncpy
atoi
fopen
fwrite
fclose
_strlwr
strstr
strchr
sprintf
malloc
free
wcscmp

kernel32

SetFileAttributesA
GlobalUnlock
GlobalLock
OpenProcess
TerminateProcess
CreateThread
GetTickCount
TerminateThread
DeleteFileA
GetFileSize
CloseHandle
WriteFile
CreateFileA
GlobalAlloc
LocalAlloc
ResumeThread
SetThreadPriority
VirtualQuery
Process32Next
Process32First
CreateToolhelp32Snapshot
LocalFree
Sleep
GlobalFree
ReadFile

user32

PostMessageA
GetWindowDC
GetClientRect
GetCursorPos
GetWindow
GetTopWindow
SetForegroundWindow
ShowWindow
GetAsyncKeyState
MapVirtualKeyA
GetDesktopWindow
GetWindowThreadProcessId
keybd_event
KillTimer
SetTimer
UnhookWindowsHookEx
DispatchMessageA
TranslateMessage
GetMessageA
SetWindowsHookExA
GetKeyState
GetDC
ReleaseDC
GetForegroundWindow
PeekMessageA
CallNextHookEx
GetWindowTextA
PostThreadMessageA
ScreenToClient

gdi32

GetDIBits
DeleteDC
DeleteObject
BitBlt
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
GetPixel
GetObjectA

ole32

CreateStreamOnHGlobal

olepro32

ord251

Exports

Exports

Start

Sections

.text
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 4KB - Virtual size: 24B

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5f968af5b04a6d574b54ebbfc7e68755

Headers

File Characteristics

Imports

ws2_32

shlwapi

psapi

gdiplus

mfc42

msvcrt

kernel32

user32

gdi32

ole32

olepro32

Exports

Exports

Sections

.text Size: 24KB - Virtual size: 22KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 4KB - Virtual size: 6KB

.vmp0 Size: 4KB - Virtual size: 2KB

.vmp1 Size: 4KB - Virtual size: 24B

.reloc Size: 4KB - Virtual size: 2KB

.text
Size: 24KB - Virtual size: 22KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 4KB - Virtual size: 6KB

.vmp0
Size: 4KB - Virtual size: 2KB

.vmp1
Size: 4KB - Virtual size: 24B

.reloc
Size: 4KB - Virtual size: 2KB