Behavioral task
behavioral1
Sample
a760f794abef2a121ad3fb136f527ceb_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
a760f794abef2a121ad3fb136f527ceb_JaffaCakes118
-
Size
466KB
-
MD5
a760f794abef2a121ad3fb136f527ceb
-
SHA1
174e30c17fbde4874244c1575415ae89f67c292e
-
SHA256
9bc3e9760941d3a84f54adb971f79c4aa904946a5718e197c15ed589e63584b3
-
SHA512
d9612d74549eba63b836bb3a2464e0bcef741cec525169185621aa9a9aa83331cca67682ddad38cc1e292ea356b37bd68e1e5c3f7541183af5496b1cea50d568
-
SSDEEP
12288:jqsRkIEkwn86juMr3t/MiW5GVcu6KWr5a0PFpn:jHPE986jXjt/MiBP9U5p7n
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a760f794abef2a121ad3fb136f527ceb_JaffaCakes118
Files
-
a760f794abef2a121ad3fb136f527ceb_JaffaCakes118.exe windows:4 windows x86 arch:x86
465d26967af1346f094e36253f9c8f2f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
user32
MessageBoxA
MessageBoxA
advapi32
ControlService
ntdll
NtSetInformationFile
kernel32
WaitForSingleObject
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
Sections
.text Size: - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 25KB - Virtual size: 483KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 439KB - Virtual size: 439KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 116B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ