Behavioral task
behavioral1
Sample
400a90de71631b17811807e75c385142_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
400a90de71631b17811807e75c385142_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
400a90de71631b17811807e75c385142_JaffaCakes118
-
Size
856KB
-
MD5
400a90de71631b17811807e75c385142
-
SHA1
7a37bd88be9796e096b5595987f6d0dd17bb9399
-
SHA256
a33fa300d16edc9c42c2750ca4d4c26ca43a681a003ec47ac2de08ed02adbb3c
-
SHA512
01640a4d74be46367d95c29bb554fc343588c16e745e7b1f332462c1278c96e8cdb22b986c31647ac5b90acf37490d755007fd7afd95816a31ee5e23e0a826c3
-
SSDEEP
12288:oyek4X6pJgpbvWIiDKedzQTsV9sF38Y9CZtR8J7YFpxpWLFVEZxuko:oyd4cWbNs9UKgC57vsLO
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 400a90de71631b17811807e75c385142_JaffaCakes118
Files
-
400a90de71631b17811807e75c385142_JaffaCakes118.exe windows:4 windows x86 arch:x86
fd7eb4321cb0e159f413232ebf0102e4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasGetConnectStatusA
kernel32
LCMapStringA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetFocus
gdi32
DeleteObject
winmm
midiStreamProperty
winspool.drv
OpenPrinterA
advapi32
RegCloseKey
shell32
Shell_NotifyIconA
ole32
StgCreateDocfileOnILockBytes
oleaut32
SysAllocStringByteLen
comctl32
ImageList_Destroy
oledlg
ord8
ws2_32
setsockopt
wininet
InternetReadFile
comdlg32
GetSaveFileNameA
Sections
.text Size: - Virtual size: 514KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 280KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 211KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 140KB - Virtual size: 152KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 325KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp1 Size: 712KB - Virtual size: 710KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE