18b8180b554a0ce58fec184b94445eef_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

18b8180b554a0ce58fec184b94445eef_JaffaCakes118
Size

69KB
MD5

18b8180b554a0ce58fec184b94445eef
SHA1

6fa27f2778dfefd5897e8bdfd58e8b206ecda99f
SHA256

889b7f224acdc414ed35626c360b3120ad0acda018e313c5159d7b3de5badc82
SHA512

7f9e525c225e7f5b271799a80b96a5b1b3edb165beff5dd5e31375bd5a51a312e701fc7f9f0e7fcf3dffb997db78eba21e38be980fad082db403ad6ee1c8e69a
SSDEEP

1536:nMC3G8e8e+UAAnKnXpCmLbL9VLoWir6DE49G/1k61liFyr:nMC258gPnKnXpCm/LbLBDfgNn18F

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
18b8180b554a0ce58fec184b94445eef_JaffaCakes118

Files

18b8180b554a0ce58fec184b94445eef_JaffaCakes118
.exe windows:4 windows x86 arch:x86

5286bb404e2c8e1415a92790dda917d2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
GetModuleHandleA
GetProcAddress
VirtualProtect

shell32

ShellExecuteA

ws2_32

select

user32

MessageBoxA

Sections

.text
Size: - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 164B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ