bb0c3e573331a75f4b7027c98630765d_JaffaCakes118 | Triage

Sharing

General

Target

bb0c3e573331a75f4b7027c98630765d_JaffaCakes118
Size

3.4MB
MD5

bb0c3e573331a75f4b7027c98630765d
SHA1

4ac4c0c553ecdfa54d3a73b3da90a6c2fe94f25a
SHA256

5529f3ecffc38831bf7b094d133cb974a0b0ea10b911a503215dd79bec481179
SHA512

d9cf4f056064ca05c23b437db2cbabcc170080612ba0e8c93d614ed24f5e31c222f9c242ef394ae88bc225884fb29d3298e3bdc1b8081e5d1b2c7717a694aad0
SSDEEP

98304:HL75/dhpBJEzo2kV4Bok6UL0Rfeu+KAPFhDIE2:rThpBJ2lkqo/UL+WKyDIE

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bb0c3e573331a75f4b7027c98630765d_JaffaCakes118

Files

bb0c3e573331a75f4b7027c98630765d_JaffaCakes118
.exe windows:5 windows x86 arch:x86

6df3efb07e603b1c0925901ad98a6458

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

ord648

kernel32

Thread32Next
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

MessageBoxW

Sections

.text
Size: - Virtual size: 4.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 3.3MB - Virtual size: 3.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 172KB - Virtual size: 171KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ