Behavioral task
behavioral1
Sample
f66f67fe16862ce39296551e3951c901_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
f66f67fe16862ce39296551e3951c901_JaffaCakes118
-
Size
908KB
-
MD5
f66f67fe16862ce39296551e3951c901
-
SHA1
90fd764b6ef36e63fd3bee5aec9ca19ff9dcbc2f
-
SHA256
7ee95c09e0ee50654adf6d011325febe79f9f6d9aadf4b7f1b3027926c335fd9
-
SHA512
f90261edb83b847dc4c6700f23d08b3b87e5b2df339a1396eee420bfac01178d345a2af960e815ce44e5bea632a004f6c534da133b8672be9db02945ed096e10
-
SSDEEP
24576:zrY+Gktx0DdjXEGQBr0NWf22TzUM+HbDxB/:zUOtcrEGQ5f22P5
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f66f67fe16862ce39296551e3951c901_JaffaCakes118
Files
-
f66f67fe16862ce39296551e3951c901_JaffaCakes118.exe windows:4 windows x86 arch:x86
fd84ccbaa69478ec5fe4f56461027a07
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcmpA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
SetWindowLongA
MessageBoxA
advapi32
RegQueryInfoKeyA
ole32
CoTaskMemRealloc
oleaut32
SysAllocString
gdi32
GetStockObject
ntdll
_stricmp
Sections
.text Size: - Virtual size: 72KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 146KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 168KB - Virtual size: 868KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 739KB - Virtual size: 738KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 168B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ