Behavioral task
behavioral1
Sample
3b3c148e76f2ea4133474a9fd67e1ba7_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3b3c148e76f2ea4133474a9fd67e1ba7_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3b3c148e76f2ea4133474a9fd67e1ba7_JaffaCakes118
-
Size
197KB
-
MD5
3b3c148e76f2ea4133474a9fd67e1ba7
-
SHA1
9599413b1b8dab8b8213667ec4094423ca5497c2
-
SHA256
94db636bc0a64d4b16943ec11acf771b81191aa1658d0fadc5a9521c83888b2f
-
SHA512
2ba2d5f40a8b074ff20ac3a46667d6359023f9e47c63f904dd81a7cf64c608da856a2cd0537398015da54b0a94f815bce00fa4d11d7278e8cebf08314436808c
-
SSDEEP
6144:IK7h8AipVrCZwT3vtvKl6uu1aKX7YnQktTjLG:FhfWm2vtvKQuJKsnQktXLG
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3b3c148e76f2ea4133474a9fd67e1ba7_JaffaCakes118
Files
-
3b3c148e76f2ea4133474a9fd67e1ba7_JaffaCakes118.exe windows:4 windows x86 arch:x86
465d26967af1346f094e36253f9c8f2f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
user32
MessageBoxA
MessageBoxA
advapi32
ControlService
ntdll
NtSetInformationFile
kernel32
WaitForSingleObject
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
Sections
.text Size: - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 94KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 170KB - Virtual size: 169KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 136B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ