3b2565f8a87eee4ef16cfb1279abd784_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3b2565f8a87eee4ef16cfb1279abd784_JaffaCakes118
Size

892KB
MD5

3b2565f8a87eee4ef16cfb1279abd784
SHA1

b01cf62af76b7987b81466e49e3c734122a46e0f
SHA256

d717b5a27921e3f3a221d051afe99ad7cbffed5f0368ef16b47b973b2b2a1f8b
SHA512

91e9a9a8af38ad80f9f7ec74e06c7e1d1072d86d1b71f7b8248cdc7fd7381cdc57a9ef4091b38715078f14c8d069ffa97b077672dee30a12e3f16f2d3298d774
SSDEEP

12288:TcKR0vRl3DSO6wShnwz4X+gRPE6ejhgK9xVCInN0MMExEXnmW9dvu2FMSkQiB:Tx0vr3+hc2LRMNje8xvxxUmCu2FYQ

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3b2565f8a87eee4ef16cfb1279abd784_JaffaCakes118

Files

3b2565f8a87eee4ef16cfb1279abd784_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: - Virtual size: 364KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 430KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 760KB - Virtual size: 760KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 130KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ