Behavioral task
behavioral1
Sample
5aec370903fb1a7e903358e0e19c2b0b_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
5aec370903fb1a7e903358e0e19c2b0b_JaffaCakes118
-
Size
1.2MB
-
MD5
5aec370903fb1a7e903358e0e19c2b0b
-
SHA1
4bf2309c5d121446c876e12f772ce04ef3a7cf9a
-
SHA256
9305cd5cc86b9e77aa3683e36d47c1f8921f5a156ae987a777cee6b38eac2072
-
SHA512
5510f0f7c7d9102ffd6f6c97d06ef87f395f5b386853e146fe4c85a06d4fb38df5983f38d6f385fa9ca700eac7cec8ed4f64f66af8e8c892e0d963a2bc234147
-
SSDEEP
24576:Ep4KS40dA2rw4eSv1Rm01v2GIbBCy9rDq7F2PTqeRVJAEdX9Dy2fx6f3AEHI:Epy3XZ9RlIfbBCGr82PPjAEj/fUfZHI
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5aec370903fb1a7e903358e0e19c2b0b_JaffaCakes118
Files
-
5aec370903fb1a7e903358e0e19c2b0b_JaffaCakes118.exe windows:4 windows x86 arch:x86
659bc951458a144256bc698de5b0fdd8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamOut
ws2_32
WSAAsyncSelect
kernel32
SetLastError
GetModuleHandleA
GetProcAddress
VirtualProtect
user32
GetMenu
MessageBoxA
gdi32
Escape
winspool.drv
OpenPrinterA
advapi32
RegQueryValueExA
shell32
ShellExecuteA
ole32
CLSIDFromProgID
oleaut32
VariantChangeType
comctl32
ord17
comdlg32
ChooseColorA
Sections
.text Size: - Virtual size: 501KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 195KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 188B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ