Behavioral task
behavioral1
Sample
74f7d71a38cbb778f4e29b1919e968d8_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
74f7d71a38cbb778f4e29b1919e968d8_JaffaCakes118
-
Size
69KB
-
MD5
74f7d71a38cbb778f4e29b1919e968d8
-
SHA1
f84ba1df73cb15ec414b86179ae57e557fd37484
-
SHA256
7d34339aae0a9037d7b9c44b0ce42474fe5afdbf311586008436df366192edef
-
SHA512
44638d5e9385174a9e0df264bb8e9c5bfcf7d2be221578ae9d2a45c1d298d1680ce690cda949691c2b1d8de616f758100a8a0de9813e962cf361ee57015937ed
-
SSDEEP
1536:HhO5MuCcNZ4Br3sCUxbRioaKWOyMu331et1D:HhrcYACUxbRiBKWO9Qlet
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 74f7d71a38cbb778f4e29b1919e968d8_JaffaCakes118
Files
-
74f7d71a38cbb778f4e29b1919e968d8_JaffaCakes118.exe windows:4 windows x86 arch:x86
5f72d6705dbc3d2a76d1ef935fe7f936
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcr80
_controlfp_s
_invoke_watson
_except_handler4_common
_amsg_exit
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
_crt_debugger_hook
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
memset
kernel32
WriteFile
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoA
InterlockedCompareExchange
InterlockedExchange
GetTempPathA
CloseHandle
GetModuleHandleA
GetModuleFileNameA
LockResource
GetProcAddress
lstrcatA
SizeofResource
Sleep
LoadResource
lstrlenA
FindResourceA
CreateFileA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
wsprintfA
MessageBoxA
GetCursorPos
MessageBoxA
shell32
ShellExecuteA
Sections
. Size: - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
. Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
. Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
. Size: 512B - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp1 Size: 67KB - Virtual size: 67KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 108B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ