Behavioral task
behavioral1
Sample
82d059f43539ff51e5b9f1dddab4b879_JaffaCakes118.exe
Resource
win7-20240729-en
General
-
Target
82d059f43539ff51e5b9f1dddab4b879_JaffaCakes118
-
Size
325KB
-
MD5
82d059f43539ff51e5b9f1dddab4b879
-
SHA1
9fb9fef9d209061c5c9142319ee495bb4fc09c0d
-
SHA256
d332a1222d44bd58a78f9f275d4698a3c9aba89f3dff6de393fcdc11c8a9cbaa
-
SHA512
fa876cb0aedc898a9d087d14ea8abcdb2b5362b171b86dc26b145bd9669d152eebf5db03352541d482b5826457685d13a89d4fa0bd3286e00218d1525457d70c
-
SSDEEP
6144:NEPXlpoejUbXujWkmVsAjmpVYKARLlE5jCgqoh/7dP:NEPXlpDjUbXHkssAjmpVYKwEl1qoh/7d
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 82d059f43539ff51e5b9f1dddab4b879_JaffaCakes118
Files
-
82d059f43539ff51e5b9f1dddab4b879_JaffaCakes118.exe windows:5 windows x86 arch:x86
b8c6c6f7a65afc2108375063ad3fbf65
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mfc90
ord300
msvcr90
exit
kernel32
lstrlenA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
IsIconic
shell32
Shell_NotifyIconA
comctl32
InitCommonControlsEx
testdll
MyHook
Sections
.text Size: - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 190KB - Virtual size: 190KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.Jiack Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: - Virtual size: 82KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp2 Size: 133KB - Virtual size: 133KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 92B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ