Behavioral task
behavioral1
Sample
b6eef27972951e0c41139064596d2dda_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
b6eef27972951e0c41139064596d2dda_JaffaCakes118
-
Size
2.2MB
-
MD5
b6eef27972951e0c41139064596d2dda
-
SHA1
af0559b6f5f42f502381a812c65fce6041c7a915
-
SHA256
cf6d129d9a54c874e819ee73045710b9e73302a96198189d54573a2bcc669fd1
-
SHA512
7b08e377fa3569c00768defb19d4227b9d3cc8203cbb522800ad113952425125e76f77052a7c4c133ca7dc29ecbd97c7a87a6e5f78037d99234029cdf39dc2b2
-
SSDEEP
49152:FgdPEDSjZkPSm8XLuI0J0w4PJBYuPJ5P9:qSDrsX30iwOBYun9
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b6eef27972951e0c41139064596d2dda_JaffaCakes118
Files
-
b6eef27972951e0c41139064596d2dda_JaffaCakes118.exe windows:4 windows x86 arch:x86
63040a40dc8e35691bebac5cc4d71ba1
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasHangUpA
winmm
midiStreamOut
ws2_32
htons
kernel32
GetTimeZoneInformation
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
GetClassNameA
MessageBoxA
gdi32
CreateCompatibleBitmap
winspool.drv
ClosePrinter
advapi32
SetSecurityDescriptorDacl
shell32
SHBrowseForFolderA
ole32
StgCreateDocfileOnILockBytes
oleaut32
SafeArrayUnaccessData
comctl32
ord17
oledlg
ord8
wininet
InternetCanonicalizeUrlA
comdlg32
GetFileTitleA
Sections
.text Size: 532KB - Virtual size: 531KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 80KB - Virtual size: 313KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 120KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 180KB - Virtual size: 178KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 88KB - Virtual size: 85KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ