Behavioral task
behavioral1
Sample
b7e3238925144c6c3cd89594ff17ab54_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
b7e3238925144c6c3cd89594ff17ab54_JaffaCakes118
-
Size
2.7MB
-
MD5
b7e3238925144c6c3cd89594ff17ab54
-
SHA1
c9386d37ef5a42e637fa4671e71a6a1233ea355b
-
SHA256
b266c4a4ae7ee28b09b6cf173a4eb5c2ee4e1c738536f5d91ddac0d3033f2b6d
-
SHA512
bcde253bc7dd7fead17b90d24f314b0c336461cbfee4bb494ad0d28cc53552117b0fbd2b0db70438372224a7e0cc619a60eb37afa7a863da5c6c8d6cfc25c16a
-
SSDEEP
49152:rBj/LZn1Ts7bPSYF7k1uPJEFeoxDVPVKflyejug5CaIZDSndBO:rVPKeY6u8xJPkdOglESd
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b7e3238925144c6c3cd89594ff17ab54_JaffaCakes118
Files
-
b7e3238925144c6c3cd89594ff17ab54_JaffaCakes118.exe windows:4 windows x86 arch:x86
80f3e95a15f9d8f12b43899d4d221bcd
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamOut
ws2_32
WSAAsyncSelect
kernel32
MultiByteToWideChar
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
GetActiveWindow
MessageBoxA
gdi32
GetMapMode
winspool.drv
ClosePrinter
advapi32
RegCloseKey
shell32
ShellExecuteA
ole32
StgCreateDocfileOnILockBytes
oleaut32
VariantChangeType
comctl32
ord17
oledlg
ord8
comdlg32
ChooseColorA
Sections
.text Size: - Virtual size: 483KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 175KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 171KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.6MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 204B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ