Behavioral task
behavioral1
Sample
4bd6e6310ba5c987d9b2de68adead285_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
4bd6e6310ba5c987d9b2de68adead285_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
4bd6e6310ba5c987d9b2de68adead285_JaffaCakes118
-
Size
88KB
-
MD5
4bd6e6310ba5c987d9b2de68adead285
-
SHA1
9572f66709ac937551a5e8aa516ee52f7a5ca132
-
SHA256
837cde1d1d4d87c048200267427c17b89b32b5aabc9c5a06a1e15081f8341bdf
-
SHA512
c157d095c9b8959f5cf83fbfa8400d902599fcc02b3a954bf088ca33cb9d3896fb077ea7292d83bbf57d7892ea47486109327dcc54e04c9fb833cb7bdbd3f06e
-
SSDEEP
1536:Amd+32evqF61hsSKqKqkop3fPqGxm0y+T2JpwvbTbgE3RUnlOnGo1HB0AuW58zf:AmddevK61hoq8Gd3dbTbgiSUnP1xuDf
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4bd6e6310ba5c987d9b2de68adead285_JaffaCakes118
Files
-
4bd6e6310ba5c987d9b2de68adead285_JaffaCakes118.exe windows:4 windows x86 arch:x86
61dba3c7ea66741946bed0377e71697f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LocalFileTimeToFileTime
SystemTimeToFileTime
CreateFileA
LoadResource
FindResourceA
GetTempPathA
ResumeThread
CreateProcessA
SetThreadPriority
GetCurrentThread
SetPriorityClass
GetCurrentProcess
lstrcatA
GetEnvironmentVariableA
GetShortPathNameA
GetModuleFileNameA
Process32Next
SetFileTime
CreateToolhelp32Snapshot
TerminateProcess
OpenProcess
MoveFileExA
Module32First
FreeLibrary
GetProcAddress
LoadLibraryA
GetSystemDirectoryA
GetLastError
DeviceIoControl
GlobalFree
LoadLibraryExA
GlobalAlloc
GetModuleHandleA
ReadFile
GetFileSize
SizeofResource
WriteFile
CloseHandle
FreeResource
MoveFileA
SetFileAttributesA
DeleteFileA
Process32First
GetTickCount
GetStartupInfoA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
wsprintfA
MessageBoxA
advapi32
OpenSCManagerA
StartServiceA
CloseServiceHandle
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
ControlService
OpenServiceA
shlwapi
StrStrIA
msvcrt
_controlfp
rand
srand
strstr
printf
puts
??2@YAPAXI@Z
??3@YAXPAX@Z
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
Sections
.text Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 74KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 85KB - Virtual size: 85KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 112B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ