Behavioral task
behavioral1
Sample
fab808c233a46be5ebaa7e9e0180920d_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
fab808c233a46be5ebaa7e9e0180920d_JaffaCakes118
-
Size
2.5MB
-
MD5
fab808c233a46be5ebaa7e9e0180920d
-
SHA1
1837cf9b3ed6a6b8e915ead969f6ede6b0a5fa6c
-
SHA256
4914e15711d3b330965d9aa1031bc39d2a6d94b2caed0025b495fe0f008bcdb9
-
SHA512
48ff7f27140e0a8b6f662b1a012f62cad4dc6cc045575d98b574ececd6282911f931399a85a0507f2625547c29c3b343d49f2143f84c93eac57aff660cf879b2
-
SSDEEP
49152:V8LC1aRqtUBk9k+I8ofJ3Cr4DLwx2idgHqT2mDYTlA5QKwreYmx1MyD/V:Vwqeq9m3CrBx2WR4hD3mL/V
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fab808c233a46be5ebaa7e9e0180920d_JaffaCakes118
Files
-
fab808c233a46be5ebaa7e9e0180920d_JaffaCakes118.exe windows:4 windows x86 arch:x86
aa9c177f4c1d2dddc83233ac623de04e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
RtlUnwind
GetModuleHandleA
GetProcAddress
VirtualProtect
user32
CopyRect
MessageBoxA
gdi32
SetMapMode
winspool.drv
DocumentPropertiesA
advapi32
RegSetValueExA
comctl32
ord17
winscard
SCardReconnect
Sections
.text Size: - Virtual size: 177KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 52B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ