Behavioral task
behavioral1
Sample
2cd21f3c96fdfec98ec937a8775b7117_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2cd21f3c96fdfec98ec937a8775b7117_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2cd21f3c96fdfec98ec937a8775b7117_JaffaCakes118
-
Size
516KB
-
MD5
2cd21f3c96fdfec98ec937a8775b7117
-
SHA1
08e50341ee321d4d4a2f53233c599ca353a9795b
-
SHA256
7bfc25fe2fd2159bb78808fa26c346bd26701f2d33763ed1887eb84c1f232485
-
SHA512
84828500e44b71295b740da65ef450a47792b5996d247474137350e727a074d400092b8178ff36d31a09f9717e8a9ebf81dfa1a74e1f23c4bdfcbc383c04975e
-
SSDEEP
12288:7UjHXadyPpVGDZwohGny2c3Y8HxErk9P6:7Sq7wh1gIrk9P
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2cd21f3c96fdfec98ec937a8775b7117_JaffaCakes118
Files
-
2cd21f3c96fdfec98ec937a8775b7117_JaffaCakes118.exe windows:4 windows x86 arch:x86
465d26967af1346f094e36253f9c8f2f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
user32
MessageBoxA
MessageBoxA
advapi32
ControlService
ntdll
NtSetInformationFile
kernel32
WaitForSingleObject
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
Sections
.text Size: - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 25KB - Virtual size: 550KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 489KB - Virtual size: 488KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 96B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ