Behavioral task
behavioral1
Sample
483a074366e3556c70ca3b0d7938780b_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
483a074366e3556c70ca3b0d7938780b_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
483a074366e3556c70ca3b0d7938780b_JaffaCakes118
-
Size
73KB
-
MD5
483a074366e3556c70ca3b0d7938780b
-
SHA1
470c3681b9f3cb369fcba7f936392533e841d289
-
SHA256
bb6c6bdd46c431e866b2ce793f50fcfc83f66359cc8968c03e4155dfec2e2f04
-
SHA512
e058c40e521999bd997710f6c45d6195bfb4a4c29f48db20d1945687daf5817d7396082452f02451042f1e9597228da18d81d1334c5377ea0d16397b8b890e68
-
SSDEEP
1536:6ASVYvU/81RTl6o2GR7ulOdTW7t92tzaO4vxgidzd/:CKt1R/2GR7+7tIX4JFdx/
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 483a074366e3556c70ca3b0d7938780b_JaffaCakes118
Files
-
483a074366e3556c70ca3b0d7938780b_JaffaCakes118.exe windows:5 windows x86 arch:x86
cb55ef8ddff6ca096823fd960459bc3a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateFileW
FindFirstFileW
FindClose
FindNextFileW
GetWindowsDirectoryW
WaitForSingleObject
GetModuleHandleW
GetTickCount
Sleep
CreateProcessA
GetModuleFileNameW
GetStartupInfoA
ReadFile
GetFileSize
DeleteFileA
CreateThread
GetProcAddress
LoadLibraryA
GetCurrentProcess
GetLastError
GetSystemInfo
GetModuleHandleA
GlobalAlloc
GlobalFree
GetTempFileNameA
CreateFileA
CloseHandle
GetVersionExA
CreateToolhelp32Snapshot
GetDiskFreeSpaceA
HeapReAlloc
Process32Next
GetCurrentDirectoryW
GetSystemDirectoryA
GetFileAttributesW
GetVolumeInformationA
OpenProcess
GetDriveTypeA
GetLogicalDrives
Process32First
GetDriveTypeW
GetComputerNameA
GetProcessHeap
HeapFree
HeapAlloc
GetTempPathA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetWindowRect
GetWindowDC
ReleaseDC
GetDesktopWindow
gdi32
CreateDIBSection
CreateCompatibleDC
DeleteObject
DeleteDC
BitBlt
SelectObject
advapi32
GetTokenInformation
OpenProcessToken
GetUserNameA
CreateWellKnownSid
CheckTokenMembership
DuplicateToken
shell32
SHGetFolderPathW
ord680
ole32
CreateStreamOnHGlobal
ntdll
_snwprintf
_wcsicmp
sprintf
memcpy
memset
wininet
InternetReadFile
InternetSetOptionA
HttpOpenRequestA
HttpSendRequestA
InternetOpenA
InternetCloseHandle
HttpQueryInfoA
InternetConnectA
iphlpapi
GetAdaptersInfo
gdiplus
GdipSaveImageToStream
GdipGetImageEncodersSize
GdipDisposeImage
GdipCreateBitmapFromHBITMAP
GdipGetImageEncoders
GdiplusStartup
psapi
GetModuleFileNameExA
mpr
WNetCloseEnum
WNetOpenEnumW
WNetEnumResourceW
Sections
.text Size: - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 71KB - Virtual size: 71KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 124B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ