General
-
Target
d2d9632c5b1e08f5d575cefdc205ee26_JaffaCakes118
-
Size
47KB
-
MD5
d2d9632c5b1e08f5d575cefdc205ee26
-
SHA1
ee0e20ef3caa417ad56d55cb3d282e6a589834eb
-
SHA256
d69eca88c24aed7382d20f7cfee6b4b997f6a9ea36d28f5161f66d74008b814e
-
SHA512
fedc8fee360ee1eae34bf9d02230d13f88241f3285cb9c90d9f5825a0686a3a4d7d6381995bef6ae2d49020ed8d51b91711b299baefef2dd52763f637a4a1315
-
SSDEEP
768:VK8EUbZX8DLdttdtmbHw0Up0/+E/Tje1a4Mu70qIykETc+xGYL/FtElj4XhVvpN:V9EkytXLm00Uur7ul7bTc+xGYL//ENOv
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d2d9632c5b1e08f5d575cefdc205ee26_JaffaCakes118
Files
-
d2d9632c5b1e08f5d575cefdc205ee26_JaffaCakes118.sys windows:5 windows x86 arch:x86
7ee712d48d57933ef2a7aec419e43533
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
DbgPrint
ObfDereferenceObject
KeInsertQueueApc
KeInitializeApc
ExAllocatePoolWithTag
ObReferenceObjectByPointer
PsThreadType
PsLookupThreadByThreadId
ZwClose
ZwTerminateProcess
ObOpenObjectByPointer
PsLookupProcessByProcessId
IofCompleteRequest
IoDeleteDevice
IoDeleteSymbolicLink
ExFreePoolWithTag
DbgPrint
IoAllocateMdl
MmProbeAndLockPages
MmMapLockedPagesSpecifyCache
MmUnlockPages
IoFreeMdl
NtQuerySystemInformation
ExAllocatePool
ExFreePool
Sections
.text Size: 512B - Virtual size: 454B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 164B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
PAGE Size: 384B - Virtual size: 333B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 896B - Virtual size: 830B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 128B - Virtual size: 110B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 384B - Virtual size: 264B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ