Behavioral task
behavioral1
Sample
30abb41657623488d1262fe1e6c5e81a_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
30abb41657623488d1262fe1e6c5e81a_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
30abb41657623488d1262fe1e6c5e81a_JaffaCakes118
-
Size
80KB
-
MD5
30abb41657623488d1262fe1e6c5e81a
-
SHA1
98732614532f9f562c44854fc0653e716c1b02c8
-
SHA256
2dabcea848671abd3d4bd31731ef4da00c942dc92de149611ccea48f0c9ef831
-
SHA512
61211656c5232ebf5c031495cfc7facf96d33b9eab8afbc91326804f9fac9a5007bec86f9ca736d791202a101e178f7390dddbb421dba7b33c829ac25ba06357
-
SSDEEP
1536:48t65oTqvWWngaNmKGgTf82DMxWJyF5j1j1L4frPl:48tVhWnBNmbgTf/LJyFbQ
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 30abb41657623488d1262fe1e6c5e81a_JaffaCakes118
Files
-
30abb41657623488d1262fe1e6c5e81a_JaffaCakes118.exe windows:4 windows x86 arch:x86
7f9c707a30374eabc9e3579046e7016b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateThread
LoadLibraryA
VirtualProtect
GetModuleFileNameA
user32
GetMessageA
MessageBoxA
advapi32
DeleteService
mfc42
ord561
msvcrt
srand
msvcp60
??1_Winit@std@@QAE@XZ
ws2_32
WSACleanup
Sections
.text Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 160B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 68KB - Virtual size: 66KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ