9606992c25466d421274b4619c07ec16_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

9606992c25466d421274b4619c07ec16_JaffaCakes118
Size

18.2MB
MD5

9606992c25466d421274b4619c07ec16
SHA1

9a9c42071460ecc885877d7a1362d23c04e1bf3f
SHA256

7b0ec5954fa769389bf69e2b7c8d62ac06b6993261d79bc33fbe12332e5c4bdd
SHA512

c0ffa3b5008338336885412db62c58ec19739afcf209dd8e012810907e20d9f3097c90cf4ee61b3448505bb811c3235a5a1c6a697d9896222e89decf2fdb38b9
SSDEEP

3072:WKrLUp32BHggP7EgGAiLMUKCDKY5uVrPUf/yyfKsmSqc:pMsBAgPYgGdDKqCU3MsmSqc

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9606992c25466d421274b4619c07ec16_JaffaCakes118

Files

9606992c25466d421274b4619c07ec16_JaffaCakes118
.dll windows:4 windows x86 arch:x86

08d2941e746b2712c8a67cb231371d79

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

shlwapi

PathFileExistsA

kernel32

Process32First
FreeLibrary
GetProcAddress
LoadLibraryA
GetSystemInfo
GetModuleHandleA
GetVersionExA
CreateProcessA
MoveFileA
LoadResource
SizeofResource
FindResourceA
DeleteFileA
WideCharToMultiByte
InitializeCriticalSection
CreateMutexA
GetCurrentProcessId
GlobalUnlock
GlobalLock
LeaveCriticalSection
GetCurrentProcess
FindClose
FindNextFileA
FindFirstFileA
lstrcpyA
FreeLibraryAndExitThread
GetCurrentThreadId
GetModuleFileNameA
GetLocaleInfoW
lstrcmpiA
GetLocaleInfoA
FlushFileBuffers
SetStdHandle
LCMapStringW
LCMapStringA
InterlockedIncrement
InterlockedDecrement
GetStringTypeW
GetStringTypeA
HeapCreate
HeapDestroy
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
MultiByteToWideChar
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
HeapAlloc
HeapFree
GetOEMCP
GetACP
GetCPInfo
ExitProcess
EnterCriticalSection
DeleteCriticalSection
TlsGetValue
SetLastError
TlsFree
TlsAlloc
TlsSetValue
GetVersion
GetCommandLineA
RtlUnwind
OpenProcess
TerminateProcess
Process32Next
Sleep
GetFileSize
ReadFile
VirtualFree
GetWindowsDirectoryA
CreateFileA
SetFilePointer
WriteFile
GetLocalTime
CloseHandle
GetLastError
VirtualAlloc
CreateThread
WaitForSingleObject
GetExitCodeThread
TerminateThread
GlobalAlloc
GlobalFree
lstrlenA

user32

CloseWindow
DialogBoxParamA
EndDialog
EnumWindows
wsprintfA
MessageBoxA
GetWindowLongA
FindWindowA
FindWindowExA
GetDlgItem
InvalidateRect
GetWindowThreadProcessId
SendMessageA
IsWindowVisible
GetClassNameA
GetSystemMetrics
IsRectEmpty
ShowWindow
MoveWindow
GetWindowRect
keybd_event
mouse_event
SetCursorPos
GetCursorPos
GetKeyState
PostQuitMessage
EndPaint
SetActiveWindow
ScreenToClient
FillRect
CallWindowProcA
BeginPaint
PtInRect
TranslateMessage
DispatchMessageA
GetMessageA
SetWindowsHookExA
CallNextHookEx
IsWindow
SetForegroundWindow
SetWindowLongA
UnhookWindowsHookEx
GetForegroundWindow
SetFocus
DestroyCaret
CreateCaret
SetCaretPos
ShowCaret
DrawTextA
GetDC
ReleaseDC
EnumChildWindows
GetWindowTextA
LoadCursorA
CreateWindowExA
UpdateWindow
SetClassLongA

gdi32

SelectObject
BitBlt
DeleteDC
CreateCompatibleBitmap
CreateSolidBrush
DeleteObject
GetDIBits
GetSystemPaletteEntries
CreateCompatibleDC
GetStockObject
GetDeviceCaps
CreateDCA
GetCharWidthA

advapi32

LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListA
ShellExecuteA

dnsapi

DnsRecordListFree
DnsQuery_A

ws2_32

setsockopt
ioctlsocket
select
inet_addr
WSAStartup
WSACleanup
socket
htons
inet_ntoa
connect
gethostname
closesocket
send
recv
gethostbyname

psapi

EnumProcesses
EnumProcessModules
GetModuleFileNameExA

Sections

.text
Size: 68KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 229KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Shared
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 72KB - Virtual size: 69KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

08d2941e746b2712c8a67cb231371d79

Headers

File Characteristics

Imports

shlwapi

kernel32

user32

gdi32

advapi32

shell32

dnsapi

ws2_32

psapi

Sections

.text Size: 68KB - Virtual size: 64KB

.rdata Size: 12KB - Virtual size: 8KB

.data Size: 20KB - Virtual size: 229KB

Shared Size: 4KB - Virtual size: 1KB

.rsrc Size: 8KB - Virtual size: 6KB

.vmp0 Size: 12KB - Virtual size: 9KB

.vmp1 Size: 72KB - Virtual size: 69KB

.reloc Size: 8KB - Virtual size: 4KB

.text
Size: 68KB - Virtual size: 64KB

.rdata
Size: 12KB - Virtual size: 8KB

.data
Size: 20KB - Virtual size: 229KB

Shared
Size: 4KB - Virtual size: 1KB

.rsrc
Size: 8KB - Virtual size: 6KB

.vmp0
Size: 12KB - Virtual size: 9KB

.vmp1
Size: 72KB - Virtual size: 69KB

.reloc
Size: 8KB - Virtual size: 4KB