Behavioral task
behavioral1
Sample
c0b0c8a4a2899299ac1b6cd9ef18c9e7_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
c0b0c8a4a2899299ac1b6cd9ef18c9e7_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
c0b0c8a4a2899299ac1b6cd9ef18c9e7_JaffaCakes118
-
Size
81KB
-
MD5
c0b0c8a4a2899299ac1b6cd9ef18c9e7
-
SHA1
e93d4595b0b9cdfbf789e74b356b628aac0d32ad
-
SHA256
631d56bbfbc97a23a4934dfe71385818fd883704532196a94faae60c26271480
-
SHA512
189be98bc411c78af686c9ed34499bb847e71a2cdb2654232db161fb8dd4e728eb4e59def5c6483b21009d3a1f175ffafaeb1b43bcb42036a51606e06eeb61f4
-
SSDEEP
1536:Zg2jGzXbA9dkb6Ja6acKRmU8SNtGyh/hcMbAsIIBG8FzFJHm:2LnxjCIGyZFBG8FzO
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c0b0c8a4a2899299ac1b6cd9ef18c9e7_JaffaCakes118
Files
-
c0b0c8a4a2899299ac1b6cd9ef18c9e7_JaffaCakes118.exe windows:4 windows x86 arch:x86
af3129383eebd7d9ae3c11b106f3f92e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
iphlpapi
GetAdaptersInfo
user32
wsprintfA
MessageBoxA
shlwapi
StrStrA
advapi32
OpenServiceA
msvcrt
exit
kernel32
lstrcpyA
GetModuleHandleA
GetProcAddress
VirtualProtect
Sections
.text Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 84B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.aneswe Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE