8e3a99eb4822df9111ce6c90708f2e70_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

8e3a99eb4822df9111ce6c90708f2e70_JaffaCakes118
Size

398KB
MD5

8e3a99eb4822df9111ce6c90708f2e70
SHA1

1e1a77d0c22badcdd5d0579e02e4645801540729
SHA256

91b1191c97f8f9f090f80705f746a0561441f47d1877e1af510b62a11785a61b
SHA512

9df7c61df05355d1508eddeb5297386f6a54e042df0f29250f7be66bea81a160d45ba59d507e87baf6c6fc84b0113b33126ddf7958d5b2c788bba7e89b66c5e1
SSDEEP

12288:qFacXdqgVFntPrRgrQfiAGy3R6BgeKB8r:AaSqgvntzRgrQfiAGy3R6sB8r

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8e3a99eb4822df9111ce6c90708f2e70_JaffaCakes118

Files

8e3a99eb4822df9111ce6c90708f2e70_JaffaCakes118
.dll windows:4 windows x86 arch:x86

416fc3ad7c8629234b69fa7606cf7b02

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

RegisterWindowMessageA

advapi32

EqualSid

shell32

SHGetSpecialFolderPathW

ws2_32

gethostbyname

msvcrt

memcpy

kernel32

GetStdHandle
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

version

VerQueryValueW

Exports

Exports

MFFwSvc_AddCusInfo
MFFwSvc_AddDomainWhiteList
MFFwSvc_ApplyCusInfo
MFFwSvc_ClearCusInfo
MFFwSvc_ClearDomainWhiteList
MFFwSvc_GetIfOpMd
MFFwSvc_GetIfPolicyRule
MFFwSvc_Initialize
MFFwSvc_IsInitialized
MFFwSvc_IsStarted
MFFwSvc_StartService
MFFwSvc_StopService
MFFwSvc_Uninitialize

Sections

.text
Size: 115KB - Virtual size: 115KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 58KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 140KB - Virtual size: 139KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp2
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

416fc3ad7c8629234b69fa7606cf7b02

Headers

File Characteristics

Imports

user32

advapi32

shell32

ws2_32

msvcrt

kernel32

version

Exports

Exports

Sections

.text Size: 115KB - Virtual size: 115KB

.rdata Size: 15KB - Virtual size: 15KB

.data Size: 58KB - Virtual size: 100KB

.rsrc Size: 2KB - Virtual size: 1KB

.vmp0 Size: 10KB - Virtual size: 10KB

.vmp1 Size: 140KB - Virtual size: 139KB

.vmp2 Size: 46KB - Virtual size: 45KB

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 115KB - Virtual size: 115KB

.rdata
Size: 15KB - Virtual size: 15KB

.data
Size: 58KB - Virtual size: 100KB

.rsrc
Size: 2KB - Virtual size: 1KB

.vmp0
Size: 10KB - Virtual size: 10KB

.vmp1
Size: 140KB - Virtual size: 139KB

.vmp2
Size: 46KB - Virtual size: 45KB

.reloc
Size: 8KB - Virtual size: 8KB