Behavioral task
behavioral1
Sample
eb4231526e01c6649e9eb88414cd6f5c_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
eb4231526e01c6649e9eb88414cd6f5c_JaffaCakes118
-
Size
1.2MB
-
MD5
eb4231526e01c6649e9eb88414cd6f5c
-
SHA1
fb21e65b2e29809a4ef06e700ae5d1cba09c73a3
-
SHA256
1f6955d4735d9e834f835ba2c4d0e8e3164b6e59808921a53295d162178c75da
-
SHA512
3848e007b73164702115efa173cb35143eb4c262c0d75e9999f87531394187316f85389a4e9c9a8ac308f061b4904cfd975dcf911fbe1b8d1837cd0d98261b06
-
SSDEEP
24576:57E6l9v1AIe5GN7+MdGN7+MxY0dBiFpfGCBAmR:x1bcu7+M67+MxY0dEFp+C
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eb4231526e01c6649e9eb88414cd6f5c_JaffaCakes118
Files
-
eb4231526e01c6649e9eb88414cd6f5c_JaffaCakes118.exe windows:5 windows x86 arch:x86
5f50ca086b73de92b227fb92e5f4faf2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
rand
shlwapi
PathFindOnPathA
iphlpapi
GetAdaptersInfo
ws2_32
gethostbyname
kernel32
DeleteFileA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
MessageBoxA
advapi32
OpenSCManagerA
Sections
.text Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 146KB - Virtual size: 146KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 915KB - Virtual size: 915KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 164KB - Virtual size: 164KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 572B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ