General
-
Target
414fb65defe696b81775ba53bb7ce948_JaffaCakes118
-
Size
57KB
-
MD5
414fb65defe696b81775ba53bb7ce948
-
SHA1
54d35391ac17c58b3a54e5d3d1806e8243a6444f
-
SHA256
31165084f679bf6074094238b1cc85c3adaa610dc13083586b415667b3c6eb1c
-
SHA512
61705dccf465e0bde41d6a360678c9935ad9a032fb05ee5a58a94d04fdad6e0ac76d52c695c90fdebec256d723fce1eb75f12a6da7ce887bb45d346b0b676d6b
-
SSDEEP
1536:CDSxUkjvtJ2zViYfAr7UWzMD3l0OllvtUoCCmY:vxUqtJCAk7VRUi
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 414fb65defe696b81775ba53bb7ce948_JaffaCakes118
Files
-
414fb65defe696b81775ba53bb7ce948_JaffaCakes118.sys windows:5 windows x86 arch:x86
de047446f094c804e11717e5e52df5ad
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
KeDelayExecutionThread
ZwCreateFile
PsCreateSystemThread
ZwQueryValueKey
ZwQueryDirectoryFile
PsTerminateSystemThread
ZwQueryInformationProcess
ZwCreateSection
ZwEnumerateKey
memcpy
ExAllocatePoolWithTag
ExFreePoolWithTag
_wcsnicmp
ExGetPreviousMode
KeDetachProcess
wcslen
IoGetCurrentProcess
MmMapViewOfSection
ObReferenceObjectByHandle
KeAttachProcess
ZwOpenProcess
KeServiceDescriptorTable
RtlCompareMemory
PsGetCurrentProcessId
MmIsAddressValid
ObfDereferenceObject
MmSectionObjectType
ZwOpenKey
ZwReadFile
MmUnmapViewOfSection
ZwSetValueKey
ObQueryNameString
RtlCompareUnicodeString
RtlUnicodeStringToAnsiString
ZwWriteFile
ZwClose
IoCreateFile
RtlInitUnicodeString
_except_handler3
hal
KfLowerIrql
KeGetCurrentIrql
KfRaiseIrql
Sections
.text Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 29KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 1024B - Virtual size: 572B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 320B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ