Behavioral task
behavioral1
Sample
bd8449c8e407711e9be631b90b4947e1_JaffaCakes118.exe
Resource
win7-20240729-en
General
-
Target
bd8449c8e407711e9be631b90b4947e1_JaffaCakes118
-
Size
172KB
-
MD5
bd8449c8e407711e9be631b90b4947e1
-
SHA1
312670c4c26b88c31ffa11f0f337ae08e522a637
-
SHA256
9034a4dabd5f5ba901ba8057e049edd6e2c3ccb887d43616711d816ac20be9e6
-
SHA512
7f5330fbd5160c7bf64d85a50702ab3e20b7d9b3054bd27b66073a5829acf8035807c79e01b24ed4ed77dd992afab5fdd5de489f6aa1aa16d9a0a253d9fbdc85
-
SSDEEP
3072:J+BC3K5eqdV8rrhB/XptZRx1koFC0AZ1a6dMft/CMNgUxlTG9J/Lws:jK7dV8HhBhvzLC5al/CMHxgJ/Lws
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bd8449c8e407711e9be631b90b4947e1_JaffaCakes118
Files
-
bd8449c8e407711e9be631b90b4947e1_JaffaCakes118.exe windows:4 windows x86 arch:x86
9507bfc20af9a6050204e6504d019801
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
ControlService
ntdll
NtSetInformationFile
kernel32
GetTempPathW
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Sections
.text Size: - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 25KB - Virtual size: 109KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 145KB - Virtual size: 145KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 140B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ