Behavioral task
behavioral1
Sample
abe78697952590305e14d6dc9a45285c_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
abe78697952590305e14d6dc9a45285c_JaffaCakes118
-
Size
896KB
-
MD5
abe78697952590305e14d6dc9a45285c
-
SHA1
63e0d3cc4c79d9c5bbd580e1906adbd9238a46f0
-
SHA256
6c5ce0c61218b9b6687083dbaf780be84b062137963e25862e066538f2cda453
-
SHA512
4383eaa3d59bc294d0d8af0b03e29e2860a800a227c8b0b9a97357e4bbb92727413f417d4c3432dac39d3b470447571fae3c2cca0106001bfbda71fccf6693c8
-
SSDEEP
24576:GAM4RPvAD1YqGRkX7nfL10E/sktgC//XPa/Ata9AqBV5aKQRV2dJ:GAVRPvAD1YqGRkX7nfL10E/sktgC//X6
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource abe78697952590305e14d6dc9a45285c_JaffaCakes118
Files
-
abe78697952590305e14d6dc9a45285c_JaffaCakes118.exe windows:5 windows x86 arch:x86
90cac6b979c40018ed90635306edda86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FreeLibrary
GetCommandLineA
LoadLibraryA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetLocalTime
OpenMutexA
GetModuleHandleA
CreateMutexA
GetTickCount
QueryPerformanceCounter
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoW
HeapSetInformation
InterlockedCompareExchange
Sleep
InterlockedExchange
DecodePointer
EncodePointer
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
SetRect
shell32
ShellExecuteA
ole32
CoInitializeEx
advapi32
RegCreateKeyExA
RegQueryValueExA
RegCloseKey
RegSetValueExA
sdl_mixer
Mix_Playing
Mix_CloseAudio
Mix_HaltChannel
Mix_FreeChunk
Mix_LoadWAV_RW
Mix_PlayChannelTimed
Mix_OpenAudio
sdl_ttf
TTF_SizeUTF8
TTF_RenderUTF8_Solid
TTF_OpenFont
TTF_Init
TTF_CloseFont
sdl_net
SDLNet_AddSocket
SDLNet_TCP_Send
SDLNet_CheckSockets
SDLNet_TCP_Recv
SDLNet_AllocSocketSet
SDLNet_TCP_Open
SDLNet_ResolveHost
SDLNet_Init
SDLNet_FreeSocketSet
SDLNet_TCP_Close
SDLNet_Quit
sdl
SDL_SetVideoMode
SDL_strlcpy
SDL_SetModuleHandle
SDL_RWFromMem
SDL_LoadBMP_RW
SDL_ConvertSurface
SDL_RWFromFile
SDL_SaveBMP_RW
SDL_Flip
SDL_SetColorKey
SDL_CreateMutex
SDL_mutexV
SDL_mutexP
SDL_DestroyMutex
SDL_WaitThread
SDL_CreateThread
SDL_SetAlpha
SDL_MapRGB
SDL_FillRect
SDL_UpperBlit
SDL_FreeSurface
SDL_CreateRGBSurface
SDL_PushEvent
SDL_Quit
SDL_Init
SDL_GetError
SDL_getenv
SDL_ShowCursor
SDL_EnableUNICODE
SDL_WM_SetCaption
SDL_PollEvent
SDL_GetVideoInfo
SDL_strlcat
winmm
timeGetTime
msvcp100
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@F@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@
??_7ios_base@std@@6B@
?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?uncaught_exception@std@@YA_NXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_BADOFF@std@@3_JB
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
msvcr100
_unlock
??0exception@std@@QAE@XZ
memchr
__dllonexit
strchr
_purecall
printf
_lock
_onexit
?terminate@@YAXXZ
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
exit
_acmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_commode
_fmode
__set_app_type
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
_crt_debugger_hook
_invoke_watson
_controlfp_s
_itoa
strlen
strrchr
fprintf
remove
isprint
fgetc
isspace
setbuf
setvbuf
fgets
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??3@YAXPAX@Z
memcpy
memmove
_time64
??2@YAPAXI@Z
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
__CxxFrameHandler3
srand
??_V@YAXPAX@Z
freopen
__iob_func
strstr
fclose
fread
fseek
fopen
sprintf
memset
rand
atoi
strtok
ftell
fwrite
strncpy
strncmp
Sections
.text Size: 723KB - Virtual size: 723KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 92KB - Virtual size: 91KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 30KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ