c86789d1957683e36c7f9f25f0f9a287_JaffaCakes118 | Triage

Sharing

General

Target

c86789d1957683e36c7f9f25f0f9a287_JaffaCakes118
Size

88KB
MD5

c86789d1957683e36c7f9f25f0f9a287
SHA1

7e1b2ac9bc60561bfc6d6a36b4998d237b09eb4b
SHA256

169835e908d74f8ff0d40916e568f1a2fa5649027aab03dbb58f028ad73adbe8
SHA512

ce705c9d80678ba2ba12d2d788f79ba5e610e177af75ae8dd5e2cba0360533afb7a079da75c1dd4790cce90f833cf9a67e293b6e3256d2e43d1a3bdb59e403b1
SSDEEP

1536:Bmk++MTEP8RKHv9+jQs6p1XAV7etgWaeD2QlvbjcesDetddPNdmuxjy:rZM4uZqKEaeD2QlvbgeJNdmy

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c86789d1957683e36c7f9f25f0f9a287_JaffaCakes118

Files

c86789d1957683e36c7f9f25f0f9a287_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f1dbdafc6f8e6474d936933cead171f2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess

user32

GetDlgItemTextA
MessageBoxA

Sections

.text
Size: - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 328B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 76KB - Virtual size: 73KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 124B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ