Behavioral task
behavioral1
Sample
a3d90466e9459e6565114d37922dc403_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a3d90466e9459e6565114d37922dc403_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a3d90466e9459e6565114d37922dc403_JaffaCakes118
-
Size
144KB
-
MD5
a3d90466e9459e6565114d37922dc403
-
SHA1
5af3de8d411ed18518b64160aa552d55cd554c1c
-
SHA256
1337bec91a79b9f9af2fd18261e16df9c3f3b3059ab0ca3bad8ef8dc3f7a504a
-
SHA512
ac463d8229e9b694016ae880a95eac41c498ff33fa283b36bf32f83f00a62293207af67b346ead30a50811d2221f4eac11d12c9d4d94fcd635db05f066b99bba
-
SSDEEP
3072:drk9v1gHOKDda+KH4xqccyPOp2JcezPsSJNCg3yMM3z13:dra9gH/xuHAqccylLz0kRM3F
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a3d90466e9459e6565114d37922dc403_JaffaCakes118
Files
-
a3d90466e9459e6565114d37922dc403_JaffaCakes118.exe windows:4 windows x86 arch:x86
6233f25a182a37d11f5caebdae948f91
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord5012
msvcrt
_controlfp
kernel32
GetModuleHandleA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Sections
.text Size: - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp1 Size: 138KB - Virtual size: 137KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE