Behavioral task
behavioral1
Sample
aa077933f03e311d3e2d8e26e0e8b444_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
aa077933f03e311d3e2d8e26e0e8b444_JaffaCakes118
-
Size
1.8MB
-
MD5
aa077933f03e311d3e2d8e26e0e8b444
-
SHA1
d6460f5bcc45b7ff819b08c6f081a5b3468c1080
-
SHA256
443331054a346bb98452469925244d4ef3e81cdae6ae30310a9472f7f2f892cf
-
SHA512
15e715c50ea877ca8ca65412e68da96c46a4d16c59588fb7f0fa3bc53a195ad759055778b932d3801edae395c5746c5c7b7983f7ce9614ff85d6b3462455da3c
-
SSDEEP
49152:WCKkfiwFvokA+XpypQ9aldOUZ5R3j5DD6kyH:9l1AkTkkYZvR3VDD6kyH
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource aa077933f03e311d3e2d8e26e0e8b444_JaffaCakes118
Files
-
aa077933f03e311d3e2d8e26e0e8b444_JaffaCakes118.exe windows:4 windows x86 arch:x86
7984f3b465730c9492503ee29fc235c7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCurrentThreadId
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
EnumChildWindows
gdi32
SelectObject
winmm
midiStreamOpen
msimg32
GradientFill
winspool.drv
ClosePrinter
advapi32
RegSetValueExA
shell32
ShellExecuteA
ole32
OleInitialize
oleaut32
UnRegisterTypeLi
comctl32
ImageList_SetBkColor
ws2_32
select
comdlg32
GetFileTitleA
Sections
.text Size: - Virtual size: 760KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 188KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 345KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.8MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE