c040592db3b06d0cb23ac9fb900202e2_JaffaCakes118

General

Target
c040592db3b06d0cb23ac9fb900202e2_JaffaCakes118
Size 92KB
Sample240825-jeh8esvamn
SHA256 41532939e987d0cb47b34a9d8bff11d15e3e8855b6839ddf6930a80e9891cae0
MD5 c040592db3b06d0cb23ac9fb900202e2
SHA1 2c5b9a9377386a75bbe2718f55a425c9d5296ed8
SHA512 ef876aa44207329575ba3e75dc297ba4d39ff475a57c0bc1ae29b26c871c58731018a63b426f9b06b3a8b803cacaf724a6bf12524ecf60e9f271a7a4743e3c4c
SSDEEP 1536:9fCHpJGPFJ1VO93G6uGGIbMtaGfnBI4+KiXy/GxYEP8G:IHpoPFIJri24+Kc1x3X
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c040592db3b06d0cb23ac9fb900202e2_JaffaCakes118

File Explorer

c040592db3b06d0cb23ac9fb900202e2_JaffaCakes118

.exe 92KB

c040592db3b06d0cb23ac9fb900202e2_JaffaCakes118

IMPHASH 302dd359671de2106ff69284b911e11a
SHA256 41532939e987d0cb47b34a9d8bff11d15e3e8855b6839ddf6930a80e9891cae0
MD5 c040592db3b06d0cb23ac9fb900202e2
SHA1 2c5b9a9377386a75bbe2718f55a425c9d5296ed8
SHA512 ef876aa44207329575ba3e75dc297ba4d39ff475a57c0bc1ae29b26c871c58731018a63b426f9b06b3a8b803cacaf724a6bf12524ecf60e9f271a7a4743e3c4c
SSDEEP 1536:9fCHpJGPFJ1VO93G6uGGIbMtaGfnBI4+KiXy/GxYEP8G:IHpoPFIJri24+Kc1x3X
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

105467

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

__vbaVarSub _CIcos _adj_fptan __vbaStrI4 __vbaVarVargNofree __vbaFreeVar __vbaStrVarMove __vbaFreeVarList __vbaEnd _adj_fdiv_m64 __vbaStrErrVarCopy _adj_fprem1 ord518 __vbaCopyBytes __vbaStrCat __vbaVarTextTstEq ord660 __vbaSetSystemError __vbaHresultCheckObj __vbaLenVar _adj_fdiv_m32 __vbaAryDestruct ord592 __vbaObjSet __vbaOnError ord595 _adj_fdiv_m16i _adj_fdivr_m16i __vbaVarIndexLoad ord520 __vbaStrTextCmp __vbaRefVarAry _CIsin ord709 __vbaVargVarMove ord632 __vbaChkstk ord526 __vbaFileClose EVENT_SINK_AddRef __vbaGenerateBoundsError __vbaStrCmp ord529 __vbaAryConstruct2 __vbaVarTstEq DllFunctionCall _adj_fpatan __vbaRedim __vbaStrR8 EVENT_SINK_Release __vbaUI1I2 _CIsqrt EVENT_SINK_QueryInterface __vbaUI1I4 __vbaExceptHandler __vbaStrToUnicode __vbaPrintFile ord712 _adj_fprem _adj_fdivr_m64 __vbaR8ErrVar ord607 ord608 __vbaFPException ord717 __vbaInStrVar __vbaUbound __vbaStrVarVal __vbaVarCat ord644 ord645 _CIlog __vbaErrorOverflow __vbaFileOpen __vbaR8Str ord648 __vbaInStr _adj_fdiv_m32i _adj_fdivr_m32i ord573 __vbaStrCopy __vbaFreeStrList __vbaVarTextTstGt _adj_fdivr_m32 __vbaR8Var __vbaPowerR8 _adj_fdiv_r ord685 ord100 __vbaI4Var __vbaVarAdd __vbaAryLock __vbaVarDup __vbaStrToAnsi ord616 ord617 _CIatan __vbaStrMove ord619 _allmul __vbaLenVarB _CItan __vbaUI1Var __vbaAryUnlock __vbaFPInt _CIexp __vbaMidStmtBstr __vbaFreeObj __vbaFreeStr

kernel32

GetModuleHandleA LoadLibraryA VirtualAlloc VirtualFree GetModuleFileNameA ExitProcess

Name

.text

Size

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vmp0

Size

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE

Name

.vmp1

Size

56KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

168B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

c040592db3b06d0cb23ac9fb900202e2_JaffaCakes118

msvbvm60

kernel32

generic