Behavioral task
behavioral1
Sample
8749acc27e2291764a10a4056cfa09aa_JaffaCakes118.exe
Resource
win7-20240729-en
General
-
Target
8749acc27e2291764a10a4056cfa09aa_JaffaCakes118
-
Size
103KB
-
MD5
8749acc27e2291764a10a4056cfa09aa
-
SHA1
1498a345fcf199fd9f147008016878c4b4202882
-
SHA256
41f44dabdf1846b88640241db4ea3ba5f9b514fb833cd77325855bc968c60ae9
-
SHA512
b9edb229dc11aeca0f87814c1bc5453bcd2f7d9ea53db8af131faa34b4fb6d1648f5cdfbd9c59beb12f2570cd3379030741bc24b361de656961726e0818f4f4f
-
SSDEEP
3072:svovHl4F44QIy3kMh8Z7puR7nLN7lEvo/l:CovH44Zl3kZZ7URl7lEvo
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8749acc27e2291764a10a4056cfa09aa_JaffaCakes118
Files
-
8749acc27e2291764a10a4056cfa09aa_JaffaCakes118.exe windows:4 windows x86 arch:x86
3a84487ccd8b5f9c35bf898bbf5dee65
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
SendMessageA
IsCharAlphaNumericA
wsprintfA
GetClassNameA
MessageBoxA
oleaut32
GetErrorInfo
msvcrt
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_exit
_onexit
__dllonexit
??1type_info@@UAE@XZ
fwrite
toupper
_iob
fprintf
_splitpath
??2@YAPAXI@Z
_vsnprintf
_CxxThrowException
calloc
fseek
ftell
fread
strtoul
strchr
atoi
_strlwr
strrchr
fopen
fgets
fclose
system
mbstowcs
wcslen
wcscpy
_access
strcpy
memcmp
strcat
wcscat
strstr
_EH_prolog
__CxxFrameHandler
free
malloc
strcmp
sscanf
memcpy
srand
strncpy
strtok
memset
rand
_snprintf
strlen
sprintf
strncat
_strcmpi
_XcptFilter
_strdup
kernel32
GetFileSize
lstrcmpiA
Sleep
CreateThread
GetModuleFileNameA
ExitThread
GetLastError
InitializeCriticalSectionAndSpinCount
LocalAlloc
GetStartupInfoA
RemoveDirectoryA
FindFirstFileA
FindNextFileA
FindClose
GetLocalTime
GetWindowsDirectoryA
GetFileTime
SetFileTime
LocalFree
CreateMutexA
ReleaseMutex
ExpandEnvironmentStringsA
lstrlenA
lstrcmpA
lstrcpynA
lstrcpyA
lstrcatA
GetCurrentThread
GetCurrentProcess
TerminateProcess
OpenProcess
GetProcAddress
LoadLibraryA
GetLocaleInfoA
GetSystemDirectoryA
GetDateFormatA
GetTimeFormatA
GlobalMemoryStatus
GetVersion
GetCurrentProcessId
GetCurrentDirectoryA
DeviceIoControl
TerminateThread
GetLogicalDriveStringsA
GetDiskFreeSpaceExA
GetDriveTypeA
CreateProcessA
GetVersionExA
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
WaitForSingleObject
GetTempPathA
MoveFileA
ExitProcess
WideCharToMultiByte
GetModuleHandleA
GetFileAttributesA
SetFileAttributesA
CopyFileA
DeleteFileA
CreateFileA
TransactNamedPipe
WriteFile
CloseHandle
MultiByteToWideChar
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetTickCount
VirtualProtect
GetModuleFileNameA
ExitProcess
Sections
.text Size: - Virtual size: 82KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 417KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 102KB - Virtual size: 101KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 120B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ