Behavioral task
behavioral1
Sample
6101150a6b7cc78a83a578c6f52d08ce_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
6101150a6b7cc78a83a578c6f52d08ce_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
6101150a6b7cc78a83a578c6f52d08ce_JaffaCakes118
-
Size
1.2MB
-
MD5
6101150a6b7cc78a83a578c6f52d08ce
-
SHA1
c0898b8ca66719b1f64facbb9c86415aa7af1955
-
SHA256
e57ceda2ab9de2547b41c34308d2c30e75f499acd142cccc318c843554bdd4bf
-
SHA512
1e85b510d86a27b05a38fb148e73597eb04bc67b1f65a284414d565b8b66fcbddb15d103895908a19f4c62970142fce9a4886fdcb764c021962d6abbf5552b9d
-
SSDEEP
24576:/Ew84IZfUTdAcTlJegvP8tl9tWD8v5qvc4gvUXkP/NU3JaFFP9QDNJGEvKRRU:8wm+HJrHmTED8UuVqJaFFPSvvKR
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6101150a6b7cc78a83a578c6f52d08ce_JaffaCakes118
Files
-
6101150a6b7cc78a83a578c6f52d08ce_JaffaCakes118.exe windows:4 windows x86 arch:x86
8028687095203935dca9d28318b1fd8e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasHangUpA
winmm
midiOutReset
ws2_32
inet_ntoa
kernel32
EnterCriticalSection
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetWindowPlacement
gdi32
SelectObject
msimg32
GradientFill
winspool.drv
OpenPrinterA
advapi32
RegOpenKeyExA
shell32
SHGetSpecialFolderPathA
ole32
CoCreateInstance
oleaut32
SysAllocStringByteLen
comctl32
_TrackMouseEvent
oledlg
ord8
wininet
InternetConnectA
comdlg32
GetOpenFileNameA
Sections
.text Size: - Virtual size: 535KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 632KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 261KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 357KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp1 Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE