Behavioral task
behavioral1
Sample
71a3f29f7526efc9c399e89927a32ab6_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
71a3f29f7526efc9c399e89927a32ab6_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
71a3f29f7526efc9c399e89927a32ab6_JaffaCakes118
-
Size
263KB
-
MD5
71a3f29f7526efc9c399e89927a32ab6
-
SHA1
5f3b8c91113cacd367c303b0e6f2df66545fdf80
-
SHA256
1a9d19d4c7e9d3502ab36dc147f3b7093247321a2ef530e5f4c57d1a28b37886
-
SHA512
4de0d67afb093bc4217ee20e0a39718a37c97b9745ef989c25af1c47937838f4f445e3aca85bc4e680641538e3476e5a0e739fdae5b99057cfc21124c581064b
-
SSDEEP
6144:SMoZb0Bt2qbSNj/DNYX0X9KsJHE9EcrupR70yo+NfH:fobg2qbSNj/DNnV+EcrIR/fH
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 71a3f29f7526efc9c399e89927a32ab6_JaffaCakes118
Files
-
71a3f29f7526efc9c399e89927a32ab6_JaffaCakes118.exe windows:4 windows x86 arch:x86
ca6910e6fb473a60e37c2429884fb0b5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
VirtualProtect
user32
wsprintfA
MessageBoxA
advapi32
OpenSCManagerA
shell32
ShellExecuteA
msvcrt
_exit
Sections
.text Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 172KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 53KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 256KB - Virtual size: 256KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ