Behavioral task
behavioral1
Sample
96ab452618129ccd076e3359edcf9262_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
96ab452618129ccd076e3359edcf9262_JaffaCakes118
-
Size
51KB
-
MD5
96ab452618129ccd076e3359edcf9262
-
SHA1
6e5c5668358a6c3d965e6c5369332fdafdd00339
-
SHA256
12b874c39b22d78fc947f65a18c95301b934415d2d258104efdd42c6fd890527
-
SHA512
d3e1f4a1eee68c7a18d1885f1e5c8c0e197c3884552d023a561ebc063daec9930f78a68b1e4da742b45045605937cd783286a4e20d73d0eb8e3df5702c891786
-
SSDEEP
1536:q4P94+PGuSc2BHcJwtmAAyM2ziDnZY/HqDt8:q4P94+OuP2BqVLyM2WDZY/St
Malware Config
Signatures
-
resource yara_rule sample upx -
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 96ab452618129ccd076e3359edcf9262_JaffaCakes118
Files
-
96ab452618129ccd076e3359edcf9262_JaffaCakes118.exe windows:3 windows x86 arch:x86
8cbaf46b8e7631e4b81a8e2fa8d53da3
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Sections
UPX0 Size: - Virtual size: 24KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp1 Size: 49KB - Virtual size: 48KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 80B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ