Behavioral task
behavioral1
Sample
828b8cbb0629c1da556baf0aeabfead5_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
828b8cbb0629c1da556baf0aeabfead5_JaffaCakes118.exe
Resource
win10v2004-20240730-en
General
-
Target
828b8cbb0629c1da556baf0aeabfead5_JaffaCakes118
-
Size
984KB
-
MD5
828b8cbb0629c1da556baf0aeabfead5
-
SHA1
9ef8c18bed4843fb926dff84a2b753948de9dd55
-
SHA256
ce16ad1849e382da97461b5f3b7def2655362def3e72bf9254eb5fb38d73da24
-
SHA512
170ad6a7efe998ad5cc7d2a849e4f0377580f7d36264d58eb86d65a58d0fe6cbcbf5620d5a8b12ba4f7393ea091219c82a0b4889acf831758f4b9563c3a6f6aa
-
SSDEEP
24576:5lKyGkQ9alSf5ilaU5hCcl+qJTGYvuBB7CT+n73NLK:5lKyyaof5caU5hCtqlGcuBQT+7c
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 828b8cbb0629c1da556baf0aeabfead5_JaffaCakes118
Files
-
828b8cbb0629c1da556baf0aeabfead5_JaffaCakes118.exe windows:4 windows x86 arch:x86
feb8327460258b59c1c87471f3ab04dd
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvfw32
DrawDibDraw
avifil32
AVIStreamInfoA
winmm
midiOutReset
ws2_32
ioctlsocket
rasapi32
RasGetConnectStatusA
kernel32
Process32Next
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
ValidateRect
MessageBoxA
gdi32
SetStretchBltMode
msimg32
AlphaBlend
winspool.drv
OpenPrinterA
comdlg32
ChooseColorA
advapi32
RegCreateKeyA
shell32
ShellExecuteA
ole32
CoInitialize
oleaut32
RegisterTypeLi
comctl32
ImageList_Destroy
wininet
HttpQueryInfoA
Sections
CODE Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: - Virtual size: 989KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 205KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 503KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 435KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp1 Size: 972KB - Virtual size: 969KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE