84ddc2e657cd04234e636acca0070b5f_JaffaCakes118 | Triage

Sharing

General

Target

84ddc2e657cd04234e636acca0070b5f_JaffaCakes118
Size

92KB
MD5

84ddc2e657cd04234e636acca0070b5f
SHA1

5bc8cf9a74eaadf450df1e1da89b6283bd21b0a7
SHA256

1067b1ee685c708502440b4e8d994b9ca6c5257be81051545e2e571ebcd36696
SHA512

cac1b04c98f50382de6d851a3bf8f0e8deeeaf507084464e80a9ac7bc9760231d6990d416fee9e66cbf0318af020fc6ed6fd7d92579a6eab1bbc1199d11addef
SSDEEP

1536:7QOnr2Z76JtXnA9wSjbQpMcBsP3maSTKdbVS3Kc+wmJV05sPHUahX6g:HSZGXQ9n+BFa2Kxyc2qP7hq

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
84ddc2e657cd04234e636acca0070b5f_JaffaCakes118

Files

84ddc2e657cd04234e636acca0070b5f_JaffaCakes118
.exe windows:4 windows x86 arch:x86

95f9fb2ac2ce02aa9939b8b55003390c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualFree
GetProcAddress
VirtualAlloc
LoadLibraryA
VirtualProtect

Sections

.text
Size: - Virtual size: 386B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 158B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 76KB - Virtual size: 75KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ