Behavioral task
behavioral1
Sample
8630962cf418185f99faf4cc2156e622_JaffaCakes118.exe
Resource
win7-20240729-en
General
-
Target
8630962cf418185f99faf4cc2156e622_JaffaCakes118
-
Size
165KB
-
MD5
8630962cf418185f99faf4cc2156e622
-
SHA1
c00d02a6e18c37e379828707478a0ebe472ac430
-
SHA256
4b5a11c9e4b472ac9d6347623668448162e39afe1cbce5b1e6ea9a69c154970d
-
SHA512
32c31f7d81ce3c7d41898e398cd1d841aebf3032d6a8f25eddb75fff81b5ade282948809e1fcaab2afbbdc14e2a9b13d6647ee8a677974938bf341f4b0a7a631
-
SSDEEP
3072:h+BC3K5eqt2Hs3wG8XyQhaE5LeXNm0lkZ+en6/uVWZ9ocQkcAKZwDJ3yP:LK7IwqXYE5J1Z+06AWnDKZsCP
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8630962cf418185f99faf4cc2156e622_JaffaCakes118
Files
-
8630962cf418185f99faf4cc2156e622_JaffaCakes118.exe windows:4 windows x86 arch:x86
3fbad927aeb9f1ec50f749eaed9685f3
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
user32
MessageBoxA
MessageBoxA
advapi32
ControlService
ntdll
NtCreateFile
kernel32
TlsAlloc
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
Sections
.text Size: - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 25KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 138KB - Virtual size: 137KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 164B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ