Behavioral task
behavioral1
Sample
dcbe7112bfe6f01fc59aa3f0433b9314_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
dcbe7112bfe6f01fc59aa3f0433b9314_JaffaCakes118
-
Size
3.3MB
-
MD5
dcbe7112bfe6f01fc59aa3f0433b9314
-
SHA1
da54bf4bb16b972ad9e2e11081d45bc281235064
-
SHA256
b02a5d2f3380844444727294448352b1daebf2f248e29219c05d47e41e5d2be5
-
SHA512
77b6c6af423b51ff0072040225c51cb6c104fc0d51c696674ee59f6feffc68c24bc4ab9aadbfc9eda550ade4e5b29d29875ed572a8d51f1cc298dbb94f8ad4a5
-
SSDEEP
49152:A2kQS5EG0/3tk1+rKnphi5q1/aX6GnlN+XeufWvSvWBFGeHvY4z972khu8vIhlbh:ruEG0/21+r7klVGl4Xeu9WBYS9hu8u
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dcbe7112bfe6f01fc59aa3f0433b9314_JaffaCakes118
Files
-
dcbe7112bfe6f01fc59aa3f0433b9314_JaffaCakes118.exe windows:4 windows x86 arch:x86
11cbdfb47fdc9152560598c88ea044f0
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GlobalLock
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
LoadCursorA
MessageBoxA
advapi32
RegEnumKeyExA
ole32
CoTaskMemRealloc
oleaut32
SysStringLen
gdi32
GetStockObject
ntdll
RtlFreeHeap
Sections
.text Size: - Virtual size: 72KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 168KB - Virtual size: 4.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ