3986322f5c1cc4353f5601f5b6ce2d0c_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

3986322f5c1cc4353f5601f5b6ce2d0c_JaffaCakes118
Size

1.3MB
MD5

3986322f5c1cc4353f5601f5b6ce2d0c
SHA1

da8385331f16a7eba82ada62775c592c2a4f571c
SHA256

f46083b84f46d54cc1972dad8114156b11511fd4d722fafa8a3bf1af690c4059
SHA512

4ade60fe5f6f3ca31c70c88f08dff45dc9b76a043887ccb4f1e27904a5fd96b7dc848267c9f7c654bde93814427eb212f67cd517b68b1ec57a85861172938fe4
SSDEEP

24576:eCD+3BC+OE3TMtM6gl9RjaWHgeI1p+R9PkJMpaNIc6q7bgCFlHD4n/Q+rt53dqTi:e2UlJTMtMFdjZdIBJMp7cT3gCvHDiX

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3986322f5c1cc4353f5601f5b6ce2d0c_JaffaCakes118

Files

3986322f5c1cc4353f5601f5b6ce2d0c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

02ef15324b9c40a4ed5d99bf44b89965

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

rasapi32

RasGetConnectStatusA

iphlpapi

GetAdaptersInfo

winmm

midiOutPrepareHeader

ws2_32

closesocket

kernel32

SetEndOfFile
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

GetScrollPos

gdi32

GetPixel

msimg32

GradientFill

winspool.drv

DocumentPropertiesA

advapi32

RegCloseKey

shell32

Shell_NotifyIconA

ole32

CLSIDFromProgID

oleaut32

SafeArrayGetUBound

comctl32

_TrackMouseEvent

oledlg

ord8

wininet

InternetCanonicalizeUrlA

comdlg32

GetSaveFileNameA

Sections

.text
Size: - Virtual size: 599KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 310KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 366KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE

.vmp1
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

02ef15324b9c40a4ed5d99bf44b89965

Headers

File Characteristics

Imports

rasapi32

iphlpapi

winmm

ws2_32

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

oledlg

wininet

comdlg32

Sections

.text Size: - Virtual size: 599KB

.rdata Size: - Virtual size: 1.1MB

.data Size: - Virtual size: 310KB

.rsrc Size: 16KB - Virtual size: 30KB

.vmp0 Size: - Virtual size: 366KB

.vmp1 Size: 1.3MB - Virtual size: 1.3MB

.text
Size: - Virtual size: 599KB

.rdata
Size: - Virtual size: 1.1MB

.data
Size: - Virtual size: 310KB

.rsrc
Size: 16KB - Virtual size: 30KB

.vmp0
Size: - Virtual size: 366KB

.vmp1
Size: 1.3MB - Virtual size: 1.3MB