Behavioral task
behavioral1
Sample
1ab266cd0cf10c081282e9799eaf8e48_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
1ab266cd0cf10c081282e9799eaf8e48_JaffaCakes118
-
Size
182KB
-
MD5
1ab266cd0cf10c081282e9799eaf8e48
-
SHA1
b164aaeafdd999384342acd1932384809fae91db
-
SHA256
c1e7db845bee1a9a616a2ca702a9040ed86e338c60a43902abc32cc1e43af7b6
-
SHA512
a201f61f06d4f33fcd378fa93803f4c88d340fc2bdcf4f05b014c95df4467463030e2e7d0736b8950e86340d1f623f57666f843241523bae6ccfc78d96853ae7
-
SSDEEP
3072:Jpr3K8F/rx9A6uxsGx7fhXfx9ufYfbRfg7V2OlqkQnmqWa6fMD2raz9ToeUrcVJ1:JpuwzBuvFXfxXRYPqvmqWaG8s3cVJ1
Malware Config
Signatures
-
resource yara_rule sample upx -
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1ab266cd0cf10c081282e9799eaf8e48_JaffaCakes118
Files
-
1ab266cd0cf10c081282e9799eaf8e48_JaffaCakes118.exe windows:4 windows x86 arch:x86
9accaf4599fcf53826e1b07e3f8c0a6f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualProtect
ExitProcess
VirtualProtect
GetModuleFileNameA
ExitProcess
advapi32
RegCloseKey
oleaut32
VariantCopy
sdl
SDL_Flip
sdl_image
IMG_Load
sdl_mixer
Mix_LoadMUS
sdl_ttf
TTF_Quit
user32
CharNextA
MessageBoxA
Sections
UPX0 Size: - Virtual size: 340KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: - Virtual size: 136KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 180KB - Virtual size: 179KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 64B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ