Behavioral task
behavioral1
Sample
8cf0698166d0b0934c354a1c3a1e07b5_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
8cf0698166d0b0934c354a1c3a1e07b5_JaffaCakes118
-
Size
2.4MB
-
MD5
8cf0698166d0b0934c354a1c3a1e07b5
-
SHA1
eef7f50b61ac36304dc540e1ced28fc7d69e6568
-
SHA256
a29b76c2c6d896791be491c3472edac2f17051eecaa7bda6bcc2f807d908e184
-
SHA512
18ba89b787acf260a129f578a59ac9879eeb5a63aea4832d2a90ded3e655cf97281b6763c7cabb710198c7f10af4265c9fa785e9668e4d4b387f21ad48ca177c
-
SSDEEP
49152:Nu9dyeJXjAhT0GOHXUHWaxuMgvP7qQOsTQhJOoUWS:NleFjfJ0x1sPmQCJnC
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8cf0698166d0b0934c354a1c3a1e07b5_JaffaCakes118
Files
-
8cf0698166d0b0934c354a1c3a1e07b5_JaffaCakes118.exe windows:4 windows x86 arch:x86
11059f3ce3b002e90efaba5d9f3632f2
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WritePrivateProfileStringA
GetModuleHandleA
GetProcAddress
VirtualProtect
user32
GetClassNameA
MessageBoxA
gdi32
Escape
winspool.drv
DocumentPropertiesA
comdlg32
ChooseFontA
advapi32
RegCreateKeyExA
shell32
Shell_NotifyIconA
ole32
OleInitialize
oleaut32
VarDateFromStr
winmm
waveOutPause
comctl32
ord17
ws2_32
closesocket
Sections
.text Size: 802KB - Virtual size: 802KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 130KB - Virtual size: 130KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 134KB - Virtual size: 134KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 257KB - Virtual size: 257KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 172KB - Virtual size: 172KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 889KB - Virtual size: 889KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 168B - Virtual size: 168B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ