Behavioral task
behavioral1
Sample
ebfeddf9ff0a79d9418ad69d84684c81_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
ebfeddf9ff0a79d9418ad69d84684c81_JaffaCakes118
-
Size
2.7MB
-
MD5
ebfeddf9ff0a79d9418ad69d84684c81
-
SHA1
c4c060d1dbdc2aac9d506876a97d4073abbf496c
-
SHA256
17c6e8d4c58858948bb779e2c1f35e1d9b2cc3ef8497bca702c8d8d18c4824e8
-
SHA512
d479ab000db926244e103434cbf8468f25fb2b3419998a42cf35c7b608ecacfa10ef4fe79624f3ba3ea6a71ccf878c0b42e2e7b6f366680c66e5436d59cef886
-
SSDEEP
49152:/AYwZL/BGrx3Lq68XiIm3N0SicUb6idlA4Jx6WzzB6FJA16wMFBWWyn+L5:/LwZL/BSx3Ld8XiP3iSiteidllJvzl6h
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ebfeddf9ff0a79d9418ad69d84684c81_JaffaCakes118
Files
-
ebfeddf9ff0a79d9418ad69d84684c81_JaffaCakes118.exe windows:4 windows x86 arch:x86
e2e4775ff40042c3fb56cb9324553f78
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiOutReset
ws2_32
WSAAsyncSelect
rasapi32
RasGetConnectStatusA
kernel32
CloseHandle
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
EmptyClipboard
gdi32
GetWindowExtEx
winspool.drv
OpenPrinterA
advapi32
RegSetValueExA
shell32
ShellExecuteA
ole32
OleUninitialize
oleaut32
SafeArrayGetDim
comctl32
ImageList_Destroy
oledlg
ord8
wininet
HttpOpenRequestA
comdlg32
GetFileTitleA
Sections
.text Size: - Virtual size: 562KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 272KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 341KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp1 Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE