Behavioral task
behavioral1
Sample
47bec0fda124498f70805392f7fe4317_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
47bec0fda124498f70805392f7fe4317_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
47bec0fda124498f70805392f7fe4317_JaffaCakes118
-
Size
1.1MB
-
MD5
47bec0fda124498f70805392f7fe4317
-
SHA1
47413953effbbf2b00368a15106af53f919b9434
-
SHA256
5723088638c3a9d7d6dbe5e266fb9401125fb2f55d8998fca25675b2e6e87ceb
-
SHA512
c8ffcaae8b99bae4e0090a0d56135b8387f44d09247796db805e1a09e6c4ae8311d165e131d11cf08a732728772289674f137262540ac82a5a8bf4dfcb2bb525
-
SSDEEP
24576:fAJIIOkNuji8/CavUmsjcykufAPBVJKt0Z8xadnwfXpx75OLWV:faII14ELkufy8S2xaJmBOL
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 47bec0fda124498f70805392f7fe4317_JaffaCakes118
Files
-
47bec0fda124498f70805392f7fe4317_JaffaCakes118.exe windows:4 windows x86 arch:x86
6b6b350a4ddc52c1632a039586c34e0e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasHangUpA
kernel32
GetACP
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
TabbedTextOutA
MessageBoxA
gdi32
CreatePolygonRgn
winmm
midiOutReset
winspool.drv
ClosePrinter
advapi32
RegSetValueExA
shell32
Shell_NotifyIconA
ole32
CoFreeUnusedLibraries
oleaut32
SysAllocString
comctl32
ord17
oledlg
ord8
ws2_32
recvfrom
wininet
InternetReadFile
comdlg32
GetFileTitleA
Sections
.text Size: - Virtual size: 497KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 843KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 174KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 425KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE