b4bf6df2774f2538713fd5d790c8dbec_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b4bf6df2774f2538713fd5d790c8dbec_JaffaCakes118
Size

1.3MB
MD5

b4bf6df2774f2538713fd5d790c8dbec
SHA1

3087a5303d9f1a5dd5ec32e33e215c46a29e98f2
SHA256

d1ba1df2bd2c753de4b73ce9a1c352d2af415a9a314e3a7949f6f1bdf173cf5d
SHA512

71db2f51f94f03b71446bd32868d232130b257a2b0fb827d4c5ba236c2fec3380e08d9023022a95f782acb1f726f1f81cc11fde1631b54c479a454b30427215d
SSDEEP

24576:Qo5+DoVh5xOgWSmdDtdp6xKQpp7nAE9jhnXqlS+sinjmerkMOj1fadmSc3OTMU2b:QoIoVh5xOgwdD0KQ3Akj5XHPin6QPGvn

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b4bf6df2774f2538713fd5d790c8dbec_JaffaCakes118

Files

b4bf6df2774f2538713fd5d790c8dbec_JaffaCakes118
.exe windows:4 windows x86 arch:x86

e711f00f009793bce41d88147c70ff8a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

__vbaForEachVar

kernel32

GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

Sections

.text
Size: - Virtual size: 379KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 1016KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 736KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 4KB - Virtual size: 24B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE