Behavioral task
behavioral1
Sample
f54d8c6b2eb20288921d576c9cd90f38_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
f54d8c6b2eb20288921d576c9cd90f38_JaffaCakes118
-
Size
140KB
-
MD5
f54d8c6b2eb20288921d576c9cd90f38
-
SHA1
c3ae88a7246e0a4b606f4e37a399aa2445bfa316
-
SHA256
4635fcafeb21b8f0da96e01a1a86725826aef1242cc5090556cf6dd87d49faee
-
SHA512
0d01f6a32341a1fa27f78c3d52da70b022ab77b0205218506a17c1b947c78a1f8fc168e8aa69493b8b11fc46213b3cf4119e67483ef2d72d728938328a318e2f
-
SSDEEP
3072:lt+zTFQL1c8uRX5qH/n7trI/SeyAm6a5fT/+CGqnP8tylL/Jxj7:XUFU15unW7NevmDS52kUl7
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f54d8c6b2eb20288921d576c9cd90f38_JaffaCakes118
Files
-
f54d8c6b2eb20288921d576c9cd90f38_JaffaCakes118.exe windows:4 windows x86 arch:x86
8c498d045038e9fc13c8a85c39c43ab2
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetTickCount
LoadLibraryA
VirtualProtect
GetModuleFileNameA
advapi32
RegSetValueExA
mpr
WNetCancelConnection2A
user32
MessageBoxA
Sections
.text Size: - Virtual size: 125KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 80KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 132KB - Virtual size: 129KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 88B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ