Behavioral task
behavioral1
Sample
dc3f64bbc35e3bb1131663957509dcc7_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
dc3f64bbc35e3bb1131663957509dcc7_JaffaCakes118
-
Size
1.0MB
-
MD5
dc3f64bbc35e3bb1131663957509dcc7
-
SHA1
88d0d51dce6eb318f326a4dba1059e1746b54cbd
-
SHA256
d0a8126034a513dddd16c2feabb623fe9ca6be62273dd9698345e982541de156
-
SHA512
5f84af5efa8707f806dffe7bb15bc04f4826fcc75592b2158971be8cc87e43bc5f0cae27a99405c859c218d396f7c9eb99473d6898f4c3570cd61347a5084b50
-
SSDEEP
24576:UFsMocg7bOcRtbubxRwRjFLfu290AYgtd4ZTYF3rvggVza:UFh0b5ubxezK290AzL4ZE1vggV
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dc3f64bbc35e3bb1131663957509dcc7_JaffaCakes118
Files
-
dc3f64bbc35e3bb1131663957509dcc7_JaffaCakes118.exe windows:5 windows x86 arch:x86
1fc862147fa7890694d10ac6514d81cc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCommandLineW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
LoadAcceleratorsW
Sections
.text Size: - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 964KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 128B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 434B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ