Behavioral task
behavioral1
Sample
dee3d19df2a1eea1ed817f29f63a52df_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
dee3d19df2a1eea1ed817f29f63a52df_JaffaCakes118
-
Size
2.9MB
-
MD5
dee3d19df2a1eea1ed817f29f63a52df
-
SHA1
3a3c8abf7c12774188fe7bd7a0fdcf7e84ea888a
-
SHA256
bf561f78a7885de122bfff3c1bd198dcd09090a94242defbdc01c43f53be1a99
-
SHA512
f7d69832cabcdd6d0084b47f6cfbebe7ba728463bf316bf38ef6b85c5e86724a030a5cd6906f2e11e0131f45c23a9a8f168301bf31f01f43d4bbb8a73f29d9e0
-
SSDEEP
49152:BRNmXosekAR/IjRUyr1qo6m1LrSrb5JC1w3dHHLUbbnQRBSUcU5HEGT4M:LNsoPkAR/AUyrx6oLo5VdHrUbbnWBSGl
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dee3d19df2a1eea1ed817f29f63a52df_JaffaCakes118
Files
-
dee3d19df2a1eea1ed817f29f63a52df_JaffaCakes118.exe windows:4 windows x86 arch:x86
cfd0a3f215e347af9823e9bd963f588c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamRestart
ws2_32
getpeername
kernel32
ExpandEnvironmentStringsA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
RegisterClipboardFormatA
gdi32
DeleteObject
winspool.drv
OpenPrinterA
advapi32
RegOpenKeyExA
shell32
ShellExecuteA
ole32
CoFreeUnusedLibraries
oleaut32
SafeArrayGetDim
comctl32
ImageList_Destroy
oledlg
ord8
wininet
DeleteUrlCacheEntry
comdlg32
GetFileTitleA
Sections
.text Size: - Virtual size: 609KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 173KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 104KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 529KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE