Behavioral task
behavioral1
Sample
822888b77900da5502c9f642024abdf7_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
822888b77900da5502c9f642024abdf7_JaffaCakes118
-
Size
796KB
-
MD5
822888b77900da5502c9f642024abdf7
-
SHA1
086b6c588ead180b3c152557b745a313d893d278
-
SHA256
9cd4cef0fca452b75f42c3e9c4dc319c3ca78184336c820e44d64a2bd6ddce8e
-
SHA512
5fa6a6364943dcd9086b0f5c9cc773a1705c3734a377ff24cbf45ea463121d2b685c3e7f518446f7c9858cac6d3cd181a6c60a1a83f51452195d88cf73804611
-
SSDEEP
12288:4u5LtpFnibJVHIs25yiPf48LDfQRpcSWx0WxFtBPcIeAJXPI1iMCXwDho73:3tpFiVVHIXhXzLDUC1mKPuiMsWK7
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 822888b77900da5502c9f642024abdf7_JaffaCakes118
Files
-
822888b77900da5502c9f642024abdf7_JaffaCakes118.exe windows:4 windows x86 arch:x86
500670908c8b2eb548b380523b4b29fd
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarSub
kernel32
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Sections
.text Size: - Virtual size: 1020KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.perplex Size: - Virtual size: 127KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 565KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 776KB - Virtual size: 772KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 96B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ