Behavioral task
behavioral1
Sample
b79c689e86f95dfa0a7b047079f5c7f8_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
b79c689e86f95dfa0a7b047079f5c7f8_JaffaCakes118
-
Size
204KB
-
MD5
b79c689e86f95dfa0a7b047079f5c7f8
-
SHA1
63559cd9aa4bf891cce667e3b840ae5cfbe428c1
-
SHA256
2f93f8af147092c9da64c07006752f75a98245ddaf14394f07b6eea65e68f93b
-
SHA512
ccfc6fa8cc5b7f56e988ba2b7b117bf223092bf5eaf6e339cc375a2c8e3e3353bdf376a41dcd1266d817cb0414d2a8fc12b2e6b459d41f73e6a16ec0d6de494e
-
SSDEEP
3072:K/ubwjDlEgdclSCyVEuDFSs6GF+vVl/OQaEyJyucicE95VmU/uGhGm:oWwpcSVbDFr+vVl3aGjE/wnGhGm
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b79c689e86f95dfa0a7b047079f5c7f8_JaffaCakes118
Files
-
b79c689e86f95dfa0a7b047079f5c7f8_JaffaCakes118.exe windows:5 windows x86 arch:x86
4d58c6153baacfba74e4de582c52a28b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetStartupInfoW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SystemParametersInfoW
MessageBoxA
gdi32
SetDCBrushColor
advapi32
RegQueryValueExA
shell32
ShellExecuteA
Sections
.text Size: - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 63KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 66KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp2 Size: 139KB - Virtual size: 139KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 140B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ