Behavioral task
behavioral1
Sample
638733cf838fda2d5f1254a12d5ae661_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
638733cf838fda2d5f1254a12d5ae661_JaffaCakes118
-
Size
3.2MB
-
MD5
638733cf838fda2d5f1254a12d5ae661
-
SHA1
d7e270385e0f5e70a51b67ca4c3138b709b215c8
-
SHA256
9bac9ead82b8e3ea5e7b2754876fa0e3375129f481b32d7e0beb9519d48c5783
-
SHA512
3f49daee7a2daeba6a0cbdf0ab69486c4fea9b7ca624669e492b3ae57ec8a7455047b5d354db9a418db9dec4df9c9473d7b8ae64746d47837e2c52d1b80f728e
-
SSDEEP
49152:+apgrBsfZdF46Q21/nKs+JEVn8Q+DOQfZwrGoJQ8ZnkRQ0Pjem8H3MCSekLjMjqU:Lg1s1fNngEiQv/r3JQgnE/VMjj
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 638733cf838fda2d5f1254a12d5ae661_JaffaCakes118
Files
-
638733cf838fda2d5f1254a12d5ae661_JaffaCakes118.exe windows:4 windows x86 arch:x86
fd84ccbaa69478ec5fe4f56461027a07
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcmpA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
SetWindowLongA
MessageBoxA
advapi32
RegQueryInfoKeyA
ole32
CoTaskMemRealloc
oleaut32
SysAllocString
gdi32
GetStockObject
ntdll
_stricmp
Sections
.text Size: - Virtual size: 72KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 146KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 168KB - Virtual size: 4.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 66KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 3.0MB - Virtual size: 3.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ