Behavioral task
behavioral1
Sample
345a26007b114d4feb9e068f291ddb43_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
345a26007b114d4feb9e068f291ddb43_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
345a26007b114d4feb9e068f291ddb43_JaffaCakes118
-
Size
474KB
-
MD5
345a26007b114d4feb9e068f291ddb43
-
SHA1
10d066a2295ce349cebc5a7fc2c45156f97f93cf
-
SHA256
d1e497b41ceee2a8354b00b6577c1e1478e526eb4c7d4db0ff6c80533b8c0a07
-
SHA512
372e7fad56abd73b2552f45c8f0041b554d21356c87d35665e5329d85384cfed47492106e57d5f9e06f509e5a61e16f8c17ac45c2b9206e1f2d67fdb9fad90dd
-
SSDEEP
12288:OccNtOyTvk1tRX+hLLwV+Z39481lxPnlwUZQw+n:Ocg9k/5+T39481l4QQbn
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 345a26007b114d4feb9e068f291ddb43_JaffaCakes118
Files
-
345a26007b114d4feb9e068f291ddb43_JaffaCakes118.exe windows:4 windows x86 arch:x86
465d26967af1346f094e36253f9c8f2f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
user32
MessageBoxA
MessageBoxA
advapi32
ControlService
ntdll
NtSetInformationFile
kernel32
WaitForSingleObject
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
Sections
.text Size: - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 25KB - Virtual size: 493KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 447KB - Virtual size: 447KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ