8c03d895ec4fd58647e4816b40869253_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8c03d895ec4fd58647e4816b40869253_JaffaCakes118
Size

649KB
MD5

8c03d895ec4fd58647e4816b40869253
SHA1

15542a336019a99ee7779c6ac8b21f84659f1a5b
SHA256

3145f396d04c8491f37aa4da2f917c90b09464f0c0bcc6811fa089e9a3318c56
SHA512

a9705196633301368f966c2afafb83ba1d86bf70a2c05bf3ce339d601bfaff7c6312a22e6360cf5902b555f93d10eefd72299a83f644e4a39b31ba4fdf147b8f
SSDEEP

12288:Qn2R2xVvdj21/a+03pgrknHahTuEwyDK0klQc1uQN72Sh+:gXby1yFZckn6hCEaKfD

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8c03d895ec4fd58647e4816b40869253_JaffaCakes118

Files

8c03d895ec4fd58647e4816b40869253_JaffaCakes118
.exe windows:4 windows x86 arch:x86

81f5b4b6fe6becb8b95be2721bcb90bb

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

_adj_fdiv_m64

user32

MessageBoxA

kernel32

GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

Sections

.text
Size: - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE

.vmp1
Size: 732KB - Virtual size: 730KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE