Behavioral task
behavioral1
Sample
dc020114ac72311cb6524a889a81247b_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
dc020114ac72311cb6524a889a81247b_JaffaCakes118
-
Size
1.3MB
-
MD5
dc020114ac72311cb6524a889a81247b
-
SHA1
8e9afaf66da83f4e3f6b92879c6625141497c14c
-
SHA256
d1f3bbfc1b84ade8970ade120a27000819ed3ce7fa5194f4e2c99266a1926ae6
-
SHA512
3e9f074eb7f05e0b04c8400d195cde1f6fb2ea359c2f752ae89661f18705f844903802474303c575fa2db574e62cd80c260a75f5422e58d485708615ec93de54
-
SSDEEP
24576:iIMuqDodXSfGvDDGSkwp7W4ZBS4ov5J3J:zdqDcXaBSX7W1n5J3J
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dc020114ac72311cb6524a889a81247b_JaffaCakes118
Files
-
dc020114ac72311cb6524a889a81247b_JaffaCakes118.exe windows:6 windows x86 arch:x86
428123211de9b6d324492cef80bdd48d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
InterlockedDecrement
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
wsprintfA
msvcp120
?uncaught_exception@std@@YA_NXZ
msvcr120
_lock
Sections
.text Size: - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 34KB - Virtual size: 681KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 976B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: - Virtual size: 539KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp3 Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 152B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 34KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ