Behavioral task
behavioral1
Sample
3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118
-
Size
415KB
-
MD5
3ba64a359b74ac8153763b5562f34a4f
-
SHA1
abdd04c17f9edaab63ccddab16160f446e24bbb1
-
SHA256
38cb941ec11b3742682daa12bf34c8ce671e444870af87fa400e16f606b0952d
-
SHA512
767e540bbb25cee2504e75c91f5c34cc647ee7783f6669aab76804a5f0a615f55b18e09682b11f2898a493be481a26489188d3342b58d5ede1baf613377f64fe
-
SSDEEP
12288:qv6ap4FpYvkOAmu02KbGqW63sYB12uoU:pap4nWF/9RbGAsYB1CU
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118
Files
-
3ba64a359b74ac8153763b5562f34a4f_JaffaCakes118.exe windows:4 windows x86 arch:x86
11cbdfb47fdc9152560598c88ea044f0
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GlobalLock
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
LoadCursorA
MessageBoxA
advapi32
RegEnumKeyExA
ole32
CoTaskMemRealloc
oleaut32
SysStringLen
gdi32
GetStockObject
ntdll
RtlFreeHeap
Sections
.text Size: - Virtual size: 72KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 168KB - Virtual size: 240KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 63KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 245KB - Virtual size: 245KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 140B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ