Behavioral task
behavioral1
Sample
7518510826d33a4ff56b27140002ea3d_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
7518510826d33a4ff56b27140002ea3d_JaffaCakes118
-
Size
1.2MB
-
MD5
7518510826d33a4ff56b27140002ea3d
-
SHA1
51d06e917bfbe9d0491e7efb0e79e768cb1fe6eb
-
SHA256
5a7b194c442bb0839ec40d49e4b5d46e38b3866670a6bfaeec36b52c5108687a
-
SHA512
eccd9c45d1a0ae9ce52f7869f85358ca299e0570ba410b249a518a5cc48337003da371f6aa6f9a5481c1e3e8395638b672b585f44697fe92c90f1052be5a2451
-
SSDEEP
24576:qoSbco9gBSouGC4W4u5bVA5OUIL6TljnAafZt443+o67d3mB3txPKo:2co9N14uE3Bjnbf147dW1PK
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7518510826d33a4ff56b27140002ea3d_JaffaCakes118
Files
-
7518510826d33a4ff56b27140002ea3d_JaffaCakes118.exe windows:5 windows x86 arch:x86
dd6017163b96eda06910ac9b03993003
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
RtlUnwind
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
DestroyWindow
gdi32
DeleteDC
advapi32
RegCreateKeyA
shell32
ShellExecuteA
ole32
StringFromGUID2
oleaut32
LoadRegTypeLi
comctl32
InitCommonControlsEx
wininet
InternetOpenUrlA
Sections
.text Size: - Virtual size: 103KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 314KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 156B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ