93fae90c6f465b0fe7791e25d22dd3f8_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

93fae90c6f465b0fe7791e25d22dd3f8_JaffaCakes118
Size

140KB
MD5

93fae90c6f465b0fe7791e25d22dd3f8
SHA1

0c308b5d9cb2fe2578d97ad1c7b9068f475428c7
SHA256

683800e87e0d79bdc15cab72d61ad95936714a7f1a3169fac8a53e91b6ce5a03
SHA512

d9aa420c827a0ad36065f3437d7547e0688aeba60674189928593e166a652c9c73e553bc800b5ebe230a3e15b71802128356134239fa03d5e1747781a6e88cb9
SSDEEP

3072:PtpxVNKFpMVPclPve6j8/cnyRqGJcAVtqsHV0:PQwVEVG08/cn3mHqX

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
93fae90c6f465b0fe7791e25d22dd3f8_JaffaCakes118

Files

93fae90c6f465b0fe7791e25d22dd3f8_JaffaCakes118
.exe windows:4 windows x86 arch:x86

0327d1076e95505a01df62aac7a4860e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

__vbaLateIdSt

kernel32

GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

Sections

.text
Size: - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 101KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 128KB - Virtual size: 127KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE