5a1663a83eb79d62405174925d1f2d77_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5a1663a83eb79d62405174925d1f2d77_JaffaCakes118
Size

776KB
MD5

5a1663a83eb79d62405174925d1f2d77
SHA1

e0f9a1fe8a02a2b2d5945d439985722191c25a06
SHA256

9e215b8524e8c032a5882b192832da1483c4843dfcb5df6f47a0732f5ff28c50
SHA512

2bea46804d057fefdace8131f245f2f77d58e2a62997e55271527523818c3719a2886064c053de74ab997baccf03e3a3ff7400908a27bffa36e50b321382b030
SSDEEP

24576:UIZVAzpCOFyJXETvYerZ8koY48mU5NLyPLz:Ubpq0TV+tU5NYz

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5a1663a83eb79d62405174925d1f2d77_JaffaCakes118

Files

5a1663a83eb79d62405174925d1f2d77_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f2e207532ce4a0ed1888c7ceb423822c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

MessageBoxA

Sections

SEC
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 22KB - Virtual size: 627KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 753KB - Virtual size: 752KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE