Behavioral task
behavioral1
Sample
3ed319921f92e58d0be6354996b183cb_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3ed319921f92e58d0be6354996b183cb_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3ed319921f92e58d0be6354996b183cb_JaffaCakes118
-
Size
57KB
-
MD5
3ed319921f92e58d0be6354996b183cb
-
SHA1
5be31fbaf64dd631c2e1af00b33f515fca16e29a
-
SHA256
7784ae42c2d3b9f70ed947b209157799c47ee35b681e47ffddb6859c839fb146
-
SHA512
16bfdafcd4038df0fc972a99ff67b02411e80dc883ce59aa8492a7d146a076be2bb90189519868724b8efa938172c3783321ff1894211923d8f8f81d0aa5b560
-
SSDEEP
1536:KccOpZ1BhX/NiVHfnZHxWB0VKXG3+d48RNIMw/oZV:Kp0hX/NiV/nlQaVqqQ48RNy/
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3ed319921f92e58d0be6354996b183cb_JaffaCakes118
Files
-
3ed319921f92e58d0be6354996b183cb_JaffaCakes118.exe windows:4 windows x86 arch:x86
3dd1ad8d9fb957d0fdaef02318dfebab
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
_except_handler3
__set_app_type
__p__fmode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
?terminate@@YAXXZ
_controlfp
__p__commode
_acmdln
exit
_cexit
_XcptFilter
_exit
_c_exit
??1type_info@@UAE@XZ
??3@YAXPAX@Z
_vsnprintf
sprintf
fopen
fputs
fclose
_CxxThrowException
__CxxFrameHandler
memset
strncpy
strncat
strlen
strchr
??2@YAPAXI@Z
strcpy
strcat
memcpy
_stricmp
_strnicmp
_strrev
kernel32
GetStartupInfoA
FindResourceA
SizeofResource
LoadResource
LockResource
FreeResource
GetLocalTime
FormatMessageA
GetVersion
CreateProcessA
WaitForSingleObject
FindFirstFileA
lstrcatA
GetTempPathA
FreeLibrary
GetProcAddress
LoadLibraryA
DeleteFileA
ExitProcess
GetLastError
Sleep
CloseHandle
LocalFree
LocalAlloc
OpenProcess
GetCurrentProcessId
GetSystemWindowsDirectoryA
MoveFileA
WriteFile
lstrlenA
CreateFileA
GetSystemDirectoryA
ReadFile
GetFileSize
SetLastError
MoveFileExA
SetFileAttributesA
FindClose
SetUnhandledExceptionFilter
OpenMutexA
lstrcpyA
lstrcmpiA
GetFileAttributesA
HeapAlloc
GetProcessHeap
HeapReAlloc
HeapFree
GetCurrentProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
SetFileTime
GetFileTime
GetModuleFileNameA
VirtualProtect
user32
GetActiveWindow
MessageBoxA
GetSystemMetrics
wsprintfA
advapi32
QueryServiceStatus
ControlService
DeleteService
LookupPrivilegeValueA
AdjustTokenPrivileges
RegCreateKeyA
RegQueryValueExA
RegSetValueExA
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerExA
RegOpenKeyExA
RegCloseKey
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
SetServiceStatus
OpenSCManagerA
CreateServiceA
OpenServiceA
CloseServiceHandle
StartServiceA
Sections
.text Size: - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 65KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 54KB - Virtual size: 54KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 536B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ