Behavioral task
behavioral1
Sample
46c8cb735a25c855ddd321d484782ee6_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
46c8cb735a25c855ddd321d484782ee6_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
46c8cb735a25c855ddd321d484782ee6_JaffaCakes118
-
Size
263KB
-
MD5
46c8cb735a25c855ddd321d484782ee6
-
SHA1
6e4663fae6a758288a45fdc9ac4ffc37b0eed0f6
-
SHA256
28ec589d75ba5d82a49fd8171a136681f3754bf0350e298b2a788b4da5cf6fef
-
SHA512
3c4890585d3b27e2ffc12eea2605e8ab574db3a57c23a28324b394c5806f3e79475ce5b3849de8853371b4d56ffaf160b8f125d46a46a47b890afe46d6c4d737
-
SSDEEP
6144:SMoZb0Bt2qbSNj/DNYX0X9KsJHE9EcrupR70yo+NfD:fobg2qbSNj/DNnV+EcrIR/fD
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 46c8cb735a25c855ddd321d484782ee6_JaffaCakes118
Files
-
46c8cb735a25c855ddd321d484782ee6_JaffaCakes118.exe windows:4 windows x86 arch:x86
ca6910e6fb473a60e37c2429884fb0b5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
VirtualProtect
user32
wsprintfA
MessageBoxA
advapi32
OpenSCManagerA
shell32
ShellExecuteA
msvcrt
_exit
Sections
.text Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 172KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 53KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 256KB - Virtual size: 256KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ