Behavioral task
behavioral1
Sample
885ef53ebe54e29c69ac37259415cf1b_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
885ef53ebe54e29c69ac37259415cf1b_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
885ef53ebe54e29c69ac37259415cf1b_JaffaCakes118
-
Size
263KB
-
MD5
885ef53ebe54e29c69ac37259415cf1b
-
SHA1
15075f5318ef2f303ad3f4d00b6a0aca645222a9
-
SHA256
498b54464ddf7d1c52c0862a4baa07ff8103aee5f721b360028bb03a16045e5b
-
SHA512
a7ec97da893bd9ce9ff1674c6e382c478bd693942c5546689c92905b08843e17e6a79dfa067cb5b2dfa15c869df6e4ee6df4bedafa62de57ef61ef919108645b
-
SSDEEP
6144:SMoZb0Bt2qbSNj/DNYX0X9KsJHE9EcrupR70yo+NfS:fobg2qbSNj/DNnV+EcrIR/fS
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 885ef53ebe54e29c69ac37259415cf1b_JaffaCakes118
Files
-
885ef53ebe54e29c69ac37259415cf1b_JaffaCakes118.exe windows:4 windows x86 arch:x86
ca6910e6fb473a60e37c2429884fb0b5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
VirtualProtect
user32
wsprintfA
MessageBoxA
advapi32
OpenSCManagerA
shell32
ShellExecuteA
msvcrt
_exit
Sections
.text Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 172KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 53KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 256KB - Virtual size: 256KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ