Behavioral task
behavioral1
Sample
44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
44e4471cf202060cfdf697253119d5d9_JaffaCakes118
-
Size
161KB
-
MD5
44e4471cf202060cfdf697253119d5d9
-
SHA1
96417ad5385964e4f01e2a3e2c65b36c7f8593f0
-
SHA256
2f49803816e2ecfc6fedae550f419d292ce39e2a9530f28a4d187ea4cfd361c7
-
SHA512
83b2f020913cfbbce9376553f698fbff50bcd5e836cd818cef9dc5c87d41298bc0a224d852ac259c3c9577a4e45cf9ec1a6c2d57cb37bfb996852df76a3d5615
-
SSDEEP
3072:Q+BC3K5eqmhd+1OIKvxeeTl+V01w4NqfMSonoPZPFrqGws/iVudcs:4K7u1IPegG1Lq0SaGXrxlfW
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 44e4471cf202060cfdf697253119d5d9_JaffaCakes118
Files
-
44e4471cf202060cfdf697253119d5d9_JaffaCakes118.exe windows:4 windows x86 arch:x86
3fbad927aeb9f1ec50f749eaed9685f3
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
user32
MessageBoxA
MessageBoxA
advapi32
ControlService
ntdll
NtCreateFile
kernel32
TlsAlloc
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
Sections
.text Size: - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 25KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 134KB - Virtual size: 134KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ