Behavioral task
behavioral1
Sample
951956ac15e5051d3c42e933fe16e72a_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
951956ac15e5051d3c42e933fe16e72a_JaffaCakes118
-
Size
120KB
-
MD5
951956ac15e5051d3c42e933fe16e72a
-
SHA1
33e842aad46adb31439ce452099fc190c701c008
-
SHA256
7d91e76937d27cfa1f41243ae4329d9ecc60e5a1ede227c9293243455904c057
-
SHA512
dfdcba320351c42330e608fa7a94e22e86a4bd8d01aed8478037aad24cf0b6b88d1405d8230b13e3f13bcf3fce6b0ee93a6f45d36ca861dd43d355b87dedccaa
-
SSDEEP
3072:LoWjAxIqoLaFKzfrbFh7HP4yV1TLLh0wZD:AIqhFKbrT7v4m
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 951956ac15e5051d3c42e933fe16e72a_JaffaCakes118
Files
-
951956ac15e5051d3c42e933fe16e72a_JaffaCakes118.exe windows:4 windows x86 arch:x86
3fa04b9a3844136b78c0f5bea3dfd07e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaStrLike
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Sections
.text Size: - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp1 Size: 108KB - Virtual size: 106KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE