Behavioral task
behavioral1
Sample
8c330c82fa25794f0bac0d52205f8cfa_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
8c330c82fa25794f0bac0d52205f8cfa_JaffaCakes118
-
Size
1.4MB
-
MD5
8c330c82fa25794f0bac0d52205f8cfa
-
SHA1
2efa3bc1ea09790d77ca2c4574445c19f6a37d99
-
SHA256
b681e55a5f261f88bcd269b681e0cacbcfb89c4af403ddaa947db3110753dd9a
-
SHA512
b2df82daeeb29d7c502f2ee5d45c06e54163c547fc45ae091fbdcb427ba50b6d844948567663d38da068ca4cb14763903bf876e9900fc6fe4be9c9eb6cba6343
-
SSDEEP
24576:3PBHBuF8zYYqcMjf7B/rWLaoGPME6eSwwfS5fOwEBacvVEacTsyKm/VrZmKzpzZW:35hvq53ZrWOoGP6rolEtvSKm9oeR4h
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8c330c82fa25794f0bac0d52205f8cfa_JaffaCakes118
Files
-
8c330c82fa25794f0bac0d52205f8cfa_JaffaCakes118.exe windows:4 windows x86 arch:x86
f5cfdbcda7e0bca7643907f8da515eb9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamOut
ws2_32
WSAAsyncSelect
kernel32
GetTimeZoneInformation
GetModuleHandleA
GetProcAddress
VirtualProtect
user32
PeekMessageA
MessageBoxA
gdi32
RectVisible
winspool.drv
ClosePrinter
advapi32
RegOpenKeyExA
shell32
ShellExecuteA
ole32
StgCreateDocfileOnILockBytes
oleaut32
VariantChangeType
comctl32
ord17
oledlg
ord8
comdlg32
ChooseColorA
Sections
.text Size: - Virtual size: 559KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 987KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 260KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 139KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ