Behavioral task
behavioral1
Sample
a0814936c1db154911f774c8b3d0247e_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
a0814936c1db154911f774c8b3d0247e_JaffaCakes118
-
Size
2.5MB
-
MD5
a0814936c1db154911f774c8b3d0247e
-
SHA1
16a4d6734fe72ec2e8743279c6e7b7c5c17d472b
-
SHA256
ae6f9783a1ceefc5c471dbc55c2f8cc747d3aad06b1c05f552ce42d6a740a84e
-
SHA512
0eadb126fe3031d2956962aea85be7f11b416a5af53980ea0da3b38e50c2a8f819da2845d965e79774d2828e690db7ace25cc411dd682b7592be7d87e0c48077
-
SSDEEP
49152:IleVtzTSxapiMaPVN7P6EexHs+dy8a9siiFLtXrAtN6FxGSDr3t:rVtMOlaPr6zxM+dfD/AtN6rx
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a0814936c1db154911f774c8b3d0247e_JaffaCakes118
Files
-
a0814936c1db154911f774c8b3d0247e_JaffaCakes118.exe windows:4 windows x86 arch:x86
4383f32bd3dc3453985694f8d6ac463b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetUserDefaultLCID
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetSysColorBrush
gdi32
SelectPalette
winmm
waveOutReset
winspool.drv
ClosePrinter
advapi32
RegCloseKey
shell32
SHGetSpecialFolderPathA
ole32
CLSIDFromProgID
oleaut32
LHashValOfNameSys
comctl32
ImageList_Destroy
ws2_32
recv
comdlg32
GetFileTitleA
Sections
.text Size: - Virtual size: 647KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 940KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 157KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE