Behavioral task
behavioral1
Sample
a900f4644f27ddf3840874379b41ce86_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
a900f4644f27ddf3840874379b41ce86_JaffaCakes118
-
Size
3.0MB
-
MD5
a900f4644f27ddf3840874379b41ce86
-
SHA1
cf649667536ad056957846a56c4127dc5f4b5b1c
-
SHA256
b646f8955099e8c3f12062a6ab0ea19f53034f0899c3aa4ca9b6457287e580a5
-
SHA512
3d6ad785673d412613c87b9ecbfa9b4f932a05c78684ba8221145c1802a1d290e4f141693cea7c07811a834f1efad0c0aab1146dabbbcc44660fae53a0b522a3
-
SSDEEP
98304:7EgrLvRBI6GayAyNTErBFCr0RY4LmkvS:ZrLvRVGPYBFHY4Lm
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a900f4644f27ddf3840874379b41ce86_JaffaCakes118
Files
-
a900f4644f27ddf3840874379b41ce86_JaffaCakes118.exe windows:5 windows x86 arch:x86
459a8dab07401daffeb51b462d41c1aa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Sleep
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
advapi32
GetFileSecurityW
comctl32
InitCommonControlsEx
comdlg32
GetFileTitleW
gdi32
CreateFontIndirectW
imm32
ImmReleaseContext
iphlpapi
GetAdaptersInfo
msimg32
TransparentBlt
oleaut32
VariantClear
shell32
ExtractIconW
shlwapi
PathFindFileNameW
user32
IsClipboardFormatAvailable
wininet
InternetCloseHandle
winmm
PlaySoundW
winspool.drv
ClosePrinter
gdiplus
GdipCreateBitmapFromScan0
ole32
CreateILockBytesOnHGlobal
oledlg
OleUIBusyW
urlmon
URLDownloadToFileW
Sections
.textbss Size: - Virtual size: 4.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 144KB - Virtual size: 144KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 24KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 44KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ