Behavioral task
behavioral1
Sample
429d97c744195aeccee73c5b4c5bb660_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
429d97c744195aeccee73c5b4c5bb660_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
429d97c744195aeccee73c5b4c5bb660_JaffaCakes118
-
Size
173KB
-
MD5
429d97c744195aeccee73c5b4c5bb660
-
SHA1
8668e825ca32efb26c52f0d4008a84a08d5f80df
-
SHA256
a04e20abf6b33003ae72a7bc7b28a6c1391a118bc760701fd88b26a7112bba2d
-
SHA512
60006f27bef3ef478f8b25999315b92734124442d626a210ace8c426746b2cdb1f41ce8751b5323376969edcf069c196a26943a341137b8b392cd1e257afb3af
-
SSDEEP
3072:laXMYcmgcA/CGn89suUOuEemnx131Cn4tzSXLrMaSYYmRhBbz+3eXKR:la8Y6LCGYsuUOuEemXFCnA2xRYiA0KR
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 429d97c744195aeccee73c5b4c5bb660_JaffaCakes118
Files
-
429d97c744195aeccee73c5b4c5bb660_JaffaCakes118.exe windows:4 windows x86 arch:x86
45050e812a522d3eee9e484a967816b1
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
PeekNamedPipe
WriteFile
GetFileSize
CreateFileA
GetLastError
SetFilePointer
GetCurrentProcess
GetDiskFreeSpaceA
GetDriveTypeA
GlobalMemoryStatus
ReadFile
GetSystemPowerStatus
GetSystemInfo
GetComputerNameA
WideCharToMultiByte
GetProcAddress
GetModuleHandleA
OpenProcess
TerminateProcess
MultiByteToWideChar
ExitThread
GetVersionExA
Sleep
CloseHandle
FindResourceA
LoadResource
SizeofResource
LockResource
CreatePipe
GetStartupInfoA
CreateProcessA
CreateThread
TerminateThread
DeleteFileA
GetModuleFileNameA
GetTickCount
lstrlenA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
wsprintfA
MessageBoxA
advapi32
LookupPrivilegeValueA
RegSetValueExA
GetTokenInformation
LookupAccountSidA
GetUserNameA
OpenProcessToken
RegCloseKey
AdjustTokenPrivileges
LogonUserA
CreateProcessAsUserA
RegOpenKeyA
netapi32
NetServerEnum
NetApiBufferFree
wininet
InternetQueryOptionA
HttpSendRequestExA
HttpEndRequestA
InternetReadFile
InternetCloseHandle
InternetWriteFile
InternetSetOptionA
InternetOpenA
InternetConnectA
HttpOpenRequestA
InternetGetConnectedState
ws2_32
gethostbyname
gethostname
WSACleanup
WSAStartup
inet_ntoa
msvcrt
_EH_prolog
strlen
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
??0exception@@QAE@ABQBD@Z
_wcsnicmp
_CxxThrowException
_controlfp
??1type_info@@UAE@XZ
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
atoi
memchr
??3@YAXPAX@Z
free
malloc
fclose
fwrite
fopen
atof
sprintf
strncpy
rand
srand
time
_ftol
islower
__CxxFrameHandler
_atoi64
fwprintf
fprintf
memmove
??2@YAPAXI@Z
realloc
_except_handler3
__dllonexit
_onexit
_exit
_XcptFilter
exit
_acmdln
crypt32
CertFreeCertificateContext
CertFindCertificateInStore
CertOpenSystemStoreA
CertCloseStore
Sections
.text Size: - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 460KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 171KB - Virtual size: 170KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ