Behavioral task
behavioral1
Sample
a58e932fed9d7e4eb3102320de06fbde_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
a58e932fed9d7e4eb3102320de06fbde_JaffaCakes118
-
Size
924KB
-
MD5
a58e932fed9d7e4eb3102320de06fbde
-
SHA1
e5fe81bc220d705f2a11584c997ee798f97439c4
-
SHA256
6110e1f067c1c518db61f4cc2b2d5e521865078e8a271e7a65e26dcc9f207e5e
-
SHA512
d9216de9bd11fbd258af009e66e7319ee5b658e8e9702e9cef7e6bfc317ea7d9fe9f748f4830c368551ae318ba4984b34e10b95554c9544dcc70674b1320def9
-
SSDEEP
24576:faobphsXqogahUWH+zj86IHqpIM0UX2t6lshd8g9BekqfVLm:faeh47s46IPBUXrsj1Vq
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a58e932fed9d7e4eb3102320de06fbde_JaffaCakes118
Files
-
a58e932fed9d7e4eb3102320de06fbde_JaffaCakes118.exe windows:4 windows x86 arch:x86
ede33f13066290edcbfb6bf3296e16e2
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasHangUpA
kernel32
GetTickCount
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
SetClipboardData
MessageBoxA
gdi32
SetMapMode
winmm
midiStreamRestart
winspool.drv
OpenPrinterA
advapi32
RegQueryValueA
shell32
ShellExecuteA
ole32
CreateILockBytesOnHGlobal
oleaut32
VariantClear
comctl32
ord17
oledlg
ord8
ws2_32
inet_ntoa
wininet
InternetCanonicalizeUrlA
comdlg32
GetOpenFileNameA
Sections
.text Size: - Virtual size: 506KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 919KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 174KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 179KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 896KB - Virtual size: 893KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 184B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ