Behavioral task
behavioral1
Sample
b9756ed81a41c9cec752a92ac2d916f2_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
b9756ed81a41c9cec752a92ac2d916f2_JaffaCakes118
-
Size
1.4MB
-
MD5
b9756ed81a41c9cec752a92ac2d916f2
-
SHA1
5dd705aa6850f2a2f60e26cda881a0ceb1c5da9d
-
SHA256
16e9d1ab98ed8f375f39ea8e3bf069a91940b9795caca037ae9993b755011c70
-
SHA512
2fb84ed324944683cbe24bb1f99dbeaddf46a837ff46f8cbabbfd6b8811da0319641bb8e4b1a2703eeee463d2238d357da1515d1901aa9ccc0f8f59e6141e67d
-
SSDEEP
24576:a/gEAxZAORBUlXdq+OKaabRqja8P519AErzyMUxcYOSUuhWQ8IJQRmpmiwna/p63:aAMltrOKaWwLBwErzyz5RUS3lRm+p6
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b9756ed81a41c9cec752a92ac2d916f2_JaffaCakes118
Files
-
b9756ed81a41c9cec752a92ac2d916f2_JaffaCakes118.exe windows:4 windows x86 arch:x86
bea6f281535325a145bae19135381ade
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
DuplicateHandle
GetModuleHandleA
GetProcAddress
VirtualProtect
user32
MessageBoxA
MessageBoxA
gdi32
RealizePalette
winmm
midiStreamRestart
winspool.drv
ClosePrinter
advapi32
RegCreateKeyExA
shell32
ShellExecuteA
ole32
CreateILockBytesOnHGlobal
oleaut32
SafeArrayUnaccessData
comctl32
ord17
oledlg
ord8
ws2_32
closesocket
comdlg32
GetSaveFileNameA
Sections
.text Size: - Virtual size: 542KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 983KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 210KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 36KB - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 139KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 180B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ