Behavioral task
behavioral1
Sample
fd4c802aaf2e6a1aa19c535d33fb5ca8_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
fd4c802aaf2e6a1aa19c535d33fb5ca8_JaffaCakes118
-
Size
47KB
-
MD5
fd4c802aaf2e6a1aa19c535d33fb5ca8
-
SHA1
0bd83780d377cc1438a7dc2ca30bea5b5c3fafd7
-
SHA256
14427621b7407c9ec1364c2d2bbd85a2bb9341e739e3ec5f92e8df1c45b6ecb2
-
SHA512
9fe1b715a1ee8c1f23152f77220608476225013a7d4303c04aa515d3037139dfb09f73bc3c440dadf1dbae78ff9876a4cf6736dff36df13bc1ce6119541b46ee
-
SSDEEP
768:5yEsvw5YKmQyw2+Q9dWvBGsK33QZP6LPOySQB+0/URTFU6E7LZh0OH/3lLDLtMcD:UEsvcY6ywKGGsKnQpDR4TGVMDt3lDLdL
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fd4c802aaf2e6a1aa19c535d33fb5ca8_JaffaCakes118
Files
-
fd4c802aaf2e6a1aa19c535d33fb5ca8_JaffaCakes118.exe windows:4 windows x86 arch:x86
61a741ca50275bce1e3ceaa2514de95c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
MessageBoxA
MessageBoxA
kernel32
FreeLibrary
lstrcatA
GetModuleFileNameA
ExitProcess
LoadLibraryA
GetProcAddress
lstrlenA
VirtualProtect
GetModuleFileNameA
ExitProcess
advapi32
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
Sections
.text Size: - Virtual size: 556B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 404B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ecode Size: - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ