Behavioral task
behavioral1
Sample
20c43454def6b0bc5c0aa18b8ce2c92a_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
20c43454def6b0bc5c0aa18b8ce2c92a_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
20c43454def6b0bc5c0aa18b8ce2c92a_JaffaCakes118
-
Size
392KB
-
MD5
20c43454def6b0bc5c0aa18b8ce2c92a
-
SHA1
94d7b4a7d4374557b8e9d190b4d4cb25fde2600b
-
SHA256
98f978f040b5828aabf0eb4653088ee3df9e5511cf43e7255e36f7041a61b0e0
-
SHA512
eea0ae38d723fbc6843e2c10e0f04d440f0f59128de30dee31c44aeee77ec460bb5328e162a6e990f82a74cfbefa901d8ec271626c39262e70505c04691ae4ea
-
SSDEEP
6144:EznmbDPh2xd5tlkIYzYQB1fUhATqRQqDX4FW1ci1RClPSfZOeGAwTuCVv8VAtKo7:phkfo8QPfQA5qDXt1cF8BOeGpDf
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 20c43454def6b0bc5c0aa18b8ce2c92a_JaffaCakes118
Files
-
20c43454def6b0bc5c0aa18b8ce2c92a_JaffaCakes118.exe windows:4 windows x86 arch:x86
b1a2419815e3b414a455b2f146dcb38e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
EVENT_SINK_GetIDsOfNames
MethCallEngine
EVENT_SINK_Invoke
ord518
ord626
ord660
ord662
Zombie_GetTypeInfo
ord593
ord594
ord595
ord598
ord520
ord525
ord632
ord526
EVENT_SINK_AddRef
ord528
ord561
DllFunctionCall
Zombie_GetTypeInfoCount
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord711
ord607
ord608
ord531
ord717
ord319
ProcCallEngine
ord644
ord645
ord571
ord573
ord681
ord100
ord579
ord320
ord321
ord614
ord616
ord617
ord619
ord546
ord656
ord581
kernel32
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 372KB - Virtual size: 370KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 152B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ