431568aebba9f23ea3529aa45b383a9e_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

431568aebba9f23ea3529aa45b383a9e_JaffaCakes118
Size

559KB
MD5

431568aebba9f23ea3529aa45b383a9e
SHA1

3dd7ff9591d87aa934ad11fee6ab6a2d40a2e1da
SHA256

2d2666ede716fac3135b7564416764737109f776ac157eaf2b5e01743b1f98b2
SHA512

3a9806239cfb0f52c43f7da4fbe59611feb380d74f00b82f26a6ae0a4e4597361dc4aaf5065049008dd957a4c539b0297e65167c2c08a629065b5768f0bd3b44
SSDEEP

12288:HGMc1GjGNaWwJe9jaAX2rrrK8HqF2wM0N9ImP74d6UkeVrs:Vc1GNJetIr9GW0D/7gTVrs

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
431568aebba9f23ea3529aa45b383a9e_JaffaCakes118

Files

431568aebba9f23ea3529aa45b383a9e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: - Virtual size: 401KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 145KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 328KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE

.tls
Size: 4KB - Virtual size: 24B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 556KB - Virtual size: 555KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE