Behavioral task
behavioral1
Sample
f01c85757d2c6bd447645c955785d2f8_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
f01c85757d2c6bd447645c955785d2f8_JaffaCakes118
-
Size
1.4MB
-
MD5
f01c85757d2c6bd447645c955785d2f8
-
SHA1
03f904f2a7bdd858eca05dd29ef11ee3d87e0291
-
SHA256
d60252fefe733c67773a36e49a26c47182d331f6e114ac0565b9ddca734ac8ef
-
SHA512
f657913031c7494df584ec17159dd0891267ac7233ae61cbd515fc2d242ac334e32b2d35ae7842c9a3a9ec1e88b98cd85f85e38f9f4472a31e411891f1dc1c57
-
SSDEEP
24576:V9Rk8/Mv/YKvCNwOZ+JXU8+v/IDx5x+440udaEbRDyx7bO9c:V9Rk8/MH4WztSMVLucEVDy5bO
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f01c85757d2c6bd447645c955785d2f8_JaffaCakes118
Files
-
f01c85757d2c6bd447645c955785d2f8_JaffaCakes118.exe windows:4 windows x86 arch:x86
f0173d597191f0df009f83004bdbe130
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasDialA
kernel32
LoadResource
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
DestroyMenu
gdi32
Rectangle
winmm
midiOutPrepareHeader
winspool.drv
DocumentPropertiesA
advapi32
RegOpenKeyExA
shell32
Shell_NotifyIconA
ole32
OleInitialize
oleaut32
LoadTypeLi
comctl32
ImageList_Destroy
ws2_32
ioctlsocket
wininet
InternetCloseHandle
comdlg32
GetSaveFileNameA
Sections
.text Size: - Virtual size: 589KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 458KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 226KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 364KB - Virtual size: 375KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 589KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE