Behavioral task
behavioral1
Sample
749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118
-
Size
2.1MB
-
MD5
749603f5b4722486d3edc9b9c28efd3c
-
SHA1
19567d04b5f5af0a2ad9d09e01c1d69669e33f65
-
SHA256
7911777c3a33bb63b79e7ddec1a6487ccd6174dc8640693bd3d914033aa53a32
-
SHA512
443d6e341b189bbfe56132f797caa9002d35f78c1cc91d09014919ff27e5a6aa8318db31f0eee37ab178c2fc13e320bcc3880c8dd267c2c63fa1c2f9d09dbc99
-
SSDEEP
49152:5D451WwjP+GD3hNinchbucMiHNM2o+VX/sXyie+W6kVEUP5thtS:5Dx2PpROchbLM67FGyieV6kVEUdt
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118
Files
-
749603f5b4722486d3edc9b9c28efd3c_JaffaCakes118.exe windows:4 windows x86 arch:x86
fd84ccbaa69478ec5fe4f56461027a07
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcmpA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
SetWindowLongA
MessageBoxA
advapi32
RegQueryInfoKeyA
ole32
CoTaskMemRealloc
oleaut32
SysAllocString
gdi32
GetStockObject
ntdll
_stricmp
Sections
.text Size: - Virtual size: 72KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 146KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 168KB - Virtual size: 2.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 67KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 240B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ