Behavioral task
behavioral1
Sample
65f9119235e1f6bed274152766ab5082_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
65f9119235e1f6bed274152766ab5082_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
65f9119235e1f6bed274152766ab5082_JaffaCakes118
-
Size
100KB
-
MD5
65f9119235e1f6bed274152766ab5082
-
SHA1
3dd31c400f826d947ae9862ea2cd06f4aab78e38
-
SHA256
b63ab53d35cef01d3d9aba59ef2bcef6e780d70d40831b56da4766b1e1d5902c
-
SHA512
a7eea14bec31fded203bca86d903f3b32596198091fc97b5f00f7930e654cf96b74994726864916deecb3bb48e13364f7c05875837d7dce8ad25366ab8d0b67b
-
SSDEEP
1536:INiQWOFF5hyhTBixZYSHr+N5qCN5olzuqY9W8CtwugBXs:IS8Y/N5zN5otK9W0BX
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 65f9119235e1f6bed274152766ab5082_JaffaCakes118
Files
-
65f9119235e1f6bed274152766ab5082_JaffaCakes118.exe windows:4 windows x86 arch:x86
6d72a3a866c75d511c963b5756e21740
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Process32Next
lstrcmpiA
OpenProcess
TerminateProcess
CloseHandle
Process32First
CreateToolhelp32Snapshot
WriteFile
CreateFileA
LoadResource
SizeofResource
GetModuleHandleA
FindResourceA
GetWindowsDirectoryA
GlobalFree
LockResource
GlobalAlloc
Sleep
GetLastError
CreateMutexA
GetProcessHeap
HeapAlloc
GetCommandLineA
GetStartupInfoA
ExitProcess
RtlUnwind
VirtualProtect
GetModuleFileNameA
ExitProcess
shell32
ShellExecuteA
user32
MessageBoxA
Sections
.text Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 768B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 580B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 25KB - Virtual size: 129KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 73KB - Virtual size: 73KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 116B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ