da08f3d2db58d91f04182a3c255e956d_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

da08f3d2db58d91f04182a3c255e956d_JaffaCakes118
Size

254KB
MD5

da08f3d2db58d91f04182a3c255e956d
SHA1

aa4845a80dae1677453eea38b0fb218e2919b376
SHA256

2d6773b4bd7e3c9a99659d4b92d750b43d52d5ef088f3ed9046306f97f06a232
SHA512

6890b9a297661bb6fa2e5cc3739e7cf72b2cd2114c3e62d97678b9e04ffbf28b560c66cbd3ff74b46403a5208a5216d6cfac1256b856918e28d8002271c47050
SSDEEP

6144:Z/ARuqZiTd8ZO1v/TtMdRWrRMO2NRfaGt1266NgWFRCGRr2Y9R:CcpBRMOWRTt1uNgWFRCGRr3P

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
da08f3d2db58d91f04182a3c255e956d_JaffaCakes118

Files

da08f3d2db58d91f04182a3c255e956d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 159KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 248KB - Virtual size: 248KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ