Behavioral task
behavioral1
Sample
a5f64b5d76f750d5710b9b31ef8efc88_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
a5f64b5d76f750d5710b9b31ef8efc88_JaffaCakes118
-
Size
162KB
-
MD5
a5f64b5d76f750d5710b9b31ef8efc88
-
SHA1
cccf54e9c52922f5fe3ef1665b0cbaadc3439bf1
-
SHA256
579178058486bdb6f28441591be6154ecc38c32339c77747a9007a6d33eacf87
-
SHA512
44a39e02325d39e9e02988da390628c1dc5cdace6b8a0b3fb2bdef6b7611777048643f1f7f872064ca6bb62a4cd61777065df387992f5a9e513f4cedd66b2945
-
SSDEEP
3072:K+BC3K5eqCWR8dIuqfCH2HQ4BD3nr/S8nxF9wd/kJiHEpjWAGLgD3DF3avrs:SK7v2+aWHQgDXr6yxrCHiGL4BAs
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a5f64b5d76f750d5710b9b31ef8efc88_JaffaCakes118
Files
-
a5f64b5d76f750d5710b9b31ef8efc88_JaffaCakes118.exe windows:4 windows x86 arch:x86
9507bfc20af9a6050204e6504d019801
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
ControlService
ntdll
NtSetInformationFile
kernel32
GetTempPathW
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Sections
.text Size: - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 25KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 135KB - Virtual size: 135KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 112B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ