adf2823fc01951d0cb201e84f00ca2cb_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

adf2823fc01951d0cb201e84f00ca2cb_JaffaCakes118
Size

344KB
MD5

adf2823fc01951d0cb201e84f00ca2cb
SHA1

be9441b9b8ed04089bc8c55f179009f215e31a96
SHA256

e5cbb3bf8e477624647ecd52f9f4ebb62d48c2116d85784d05c4dcda5b1b25dd
SHA512

a387d8cd859b455a1d5a4966390b9bc7d9e6e5bfdad873a7f55805b66ba6fc05f3bb6f94fb34245b08b10c61c7627149213965f0369d3f17e13cfcc29f9ac1bf
SSDEEP

6144:HyEoP4h9yH1mEecoLn3R5p/yWBsZY5tTCE1iD3osUnuLOWQnL:HQ4hwcEecoLnTp/ht55CEIYLnMOW6

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
adf2823fc01951d0cb201e84f00ca2cb_JaffaCakes118

Files

adf2823fc01951d0cb201e84f00ca2cb_JaffaCakes118
.exe windows:4 windows x86 arch:x86

0ff496934237e0b53786c25f627c1a0b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetOEMCP
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess

user32

FindWindowA

advapi32

RegCloseKey

Sections

.text
Size: - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 301KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 4KB - Virtual size: 24B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 336KB - Virtual size: 335KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE