Behavioral task
behavioral1
Sample
85ab33f2c004c6f6157cd99045c1d2f7_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
85ab33f2c004c6f6157cd99045c1d2f7_JaffaCakes118
-
Size
354KB
-
MD5
85ab33f2c004c6f6157cd99045c1d2f7
-
SHA1
7fddfbc7ac9256f359f0ecd3deb382831156e9f7
-
SHA256
0cc158fc8d2f798debc742445920fcbda8ad08b15dc3fa3dedb8534bfd6bda1a
-
SHA512
d8b576c2d07e5b18d1c9db6d01a00f2da2c18217c7f6043f7d4086637028712ebc5063441bf9aee1c6524083aba13fbeaa5c5018ff85bc4be66f90a04245c30a
-
SSDEEP
6144:vtpLEzdaQZkn8ZK7JltdVzGlZ6TKd1tpQ9u0dZcc3Kd:vtpSdtyhJ/dolATKd1tpi
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 85ab33f2c004c6f6157cd99045c1d2f7_JaffaCakes118
Files
-
85ab33f2c004c6f6157cd99045c1d2f7_JaffaCakes118.exe windows:4 windows x86 arch:x86
7a5d3cbb605814998f6e2c9d38c3233f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
ExitProcess
TlsSetValue
lstrcpyA
Sleep
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
GetKeyboardType
mouse_event
MessageBoxA
advapi32
RegQueryValueExA
ReportEventA
StartServiceA
QueryServiceConfig2A
oleaut32
SysFreeString
SafeArrayPtrOfIndex
mpr
WNetGetUserA
gdi32
UnrealizeObject
comctl32
ImageList_SetIconSize
shell32
ShellExecuteA
wininet
InternetReadFile
ws2_32
gethostname
winmm
waveInUnprepareHeader
netapi32
Netbios
wsock32
WSACleanup
avicap32
capCreateCaptureWindowA
msvfw32
DrawDibDraw
urlmon
URLDownloadToFileA
Sections
.nsp0 Size: - Virtual size: 768KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.nsp1 Size: 38KB - Virtual size: 296KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.nsp2 Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 315KB - Virtual size: 314KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 136B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ