Behavioral task
behavioral1
Sample
db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118
-
Size
432KB
-
MD5
db64e021eef4e80bf5dc3d105057fdef
-
SHA1
0e0f5f5fe100daf0688adb0e5659889e0cba2509
-
SHA256
c56d074fcc09b52565e9a09cd73f190376ae552a5e190a4d682b9eeb15d72e43
-
SHA512
c432c95459788a1ff1fcde302bad2a923b1c992e472ceddae37eec1ba03a9b676970f3374aab69cbf70b0aad51ee1d4201ce8c5798163ad40d2858267ee16de4
-
SSDEEP
6144:5/n3dYapfphW6KfghETqJqFjrwK7MYE5W7LPakYxTAPiDwkrpxQVXg:5v6ap664ghfJqFjMnpqLSkIT506kpg
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118
Files
-
db64e021eef4e80bf5dc3d105057fdef_JaffaCakes118.exe windows:4 windows x86 arch:x86
11cbdfb47fdc9152560598c88ea044f0
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GlobalLock
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
LoadCursorA
MessageBoxA
advapi32
RegEnumKeyExA
ole32
CoTaskMemRealloc
oleaut32
SysStringLen
gdi32
GetStockObject
ntdll
RtlFreeHeap
Sections
.text Size: - Virtual size: 72KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 168KB - Virtual size: 250KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 67KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 262KB - Virtual size: 262KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 232B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ