Behavioral task
behavioral1
Sample
1716ae2ad8c9c37d1315cbb967f37491_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
1716ae2ad8c9c37d1315cbb967f37491_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
1716ae2ad8c9c37d1315cbb967f37491_JaffaCakes118
-
Size
92KB
-
MD5
1716ae2ad8c9c37d1315cbb967f37491
-
SHA1
c8ebb90ac1265fa218aeb627d2eb07de41d5c223
-
SHA256
a79b229e4631ced072942167bbada99ce5fa455394d098cb2d608279258d9928
-
SHA512
50a5f7c9c085a8f13823d448bac8eb540765740d2af5aa3b36946654f1b7eee0c6c7533eb87fde362da97a8a00236c26704b70d7bf03bb3ea0ac656cfeb49e93
-
SSDEEP
1536:rxyoBXk36WO9SohCou/r96P1Qot2Wm/MRh6ZUvSCwkWL/V:VXJ9SSJujE1QotVL6ZFCwkW5
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1716ae2ad8c9c37d1315cbb967f37491_JaffaCakes118
Files
-
1716ae2ad8c9c37d1315cbb967f37491_JaffaCakes118.exe windows:4 windows x86 arch:x86
a1159ef96e3aaca48271549a09cfe028
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
strncpy
strstr
??2@YAPAXI@Z
??3@YAXPAX@Z
__CxxFrameHandler
_exit
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_stricmp
advapi32
CreateServiceA
StartServiceA
RegOpenKeyA
RegSetValueExA
RegCloseKey
OpenSCManagerA
OpenServiceA
ChangeServiceConfigA
CloseServiceHandle
kernel32
GetWindowsDirectoryA
GetModuleHandleA
FindResourceA
LoadResource
LockResource
SizeofResource
SetFilePointer
GetModuleFileNameA
GetSystemDirectoryA
GetTempFileNameA
GetLastError
WriteFile
CreateFileA
GetFileSize
ReadFile
CloseHandle
GetStartupInfoA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Sections
.text Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 228B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 79KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 80KB - Virtual size: 79KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 68B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ