Behavioral task
behavioral1
Sample
d5b8a46daf55d6528b71a549885514fd_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
d5b8a46daf55d6528b71a549885514fd_JaffaCakes118
-
Size
2.0MB
-
MD5
d5b8a46daf55d6528b71a549885514fd
-
SHA1
d0044ada4614ae1440f7a0c71e069c596639439a
-
SHA256
932490ffbc2664efda2db9a216692198666a4c884227401aaa0291c11d2b24e8
-
SHA512
e7235246154f824b3a47ef408e222a0386e4c9274ed58a4da4e49b25ec826c842334039f4ef9da4529306e4391dff6b8c47d75760f99dcb1cb5a294db1920d63
-
SSDEEP
49152:UJHDoFRfqoSnaa1YEk8/+4J4Rb0ng7YOucWk9N90odY++/zvkPy/PlDoVLQ:UIioTa1YEk8G4JGb0gRuPkh08YBzhNou
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d5b8a46daf55d6528b71a549885514fd_JaffaCakes118
Files
-
d5b8a46daf55d6528b71a549885514fd_JaffaCakes118.exe windows:4 windows x86 arch:x86
e1e40e5a2844dbb81fd4252e980d1d5b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LCMapStringA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetLastActivePopup
MessageBoxA
gdi32
CombineRgn
winmm
waveOutReset
winspool.drv
OpenPrinterA
advapi32
RegOpenKeyExA
shell32
SHGetSpecialFolderPathA
ole32
OleInitialize
oleaut32
LHashValOfNameSys
comctl32
ImageList_Destroy
ws2_32
recv
comdlg32
GetSaveFileNameA
Sections
.text Size: - Virtual size: 440KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 205KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 456KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE