fc4776ac826bc3b8c259b541e9a192a5_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

fc4776ac826bc3b8c259b541e9a192a5_JaffaCakes118
Size

40KB
MD5

fc4776ac826bc3b8c259b541e9a192a5
SHA1

b1dea6a30665ba23fa3230cf3c3fab8743ad188c
SHA256

12827f887648bc1af5d778e2298ece23ba735fc814be2b87e4d3e719adb9f7a2
SHA512

c8ea2e4e1fa8b00ff844676a4c67c38636b7556f60ccd474214a30bb8899d7ba2822ea5d03a494c67d764322b884a114e018149a5b5e13cf8e3796d204796907
SSDEEP

768:aapGkX9BG0uCZb+qfcO9bd2l3yyH1UBo16xd91T1HzLE:aaU46qfcOFcRuo1K7hxzI

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fc4776ac826bc3b8c259b541e9a192a5_JaffaCakes118

Files

fc4776ac826bc3b8c259b541e9a192a5_JaffaCakes118
.dll windows:4 windows x86 arch:x86

8029e97baf065a7b5ec98cee9236ca24

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

OpenMutexA
GetProcAddress
LoadLibraryA
GetSystemDirectoryA
OutputDebugStringA
VirtualProtect
ExitProcess

user32

MessageBoxA
GetAsyncKeyState

d3dx9_37

D3DXCreateFontA

msvcp60

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

msvcrt

free
_adjust_fdiv
malloc
??2@YAPAXI@Z
__CxxFrameHandler
_initterm

Exports

Exports

Direct3DCreate9

Sections

.text
Size: - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 824B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 836B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE

.vmp2
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8029e97baf065a7b5ec98cee9236ca24

Headers

File Characteristics

Imports

kernel32

user32

d3dx9_37

msvcp60

msvcrt

Exports

Exports

Sections

.text Size: - Virtual size: 5KB

.rdata Size: - Virtual size: 1KB

.data Size: - Virtual size: 824B

.vmp0 Size: - Virtual size: 836B

.vmp1 Size: - Virtual size: 12KB

.vmp2 Size: 32KB - Virtual size: 31KB

.reloc Size: 4KB - Virtual size: 92B

.text
Size: - Virtual size: 5KB

.rdata
Size: - Virtual size: 1KB

.data
Size: - Virtual size: 824B

.vmp0
Size: - Virtual size: 836B

.vmp1
Size: - Virtual size: 12KB

.vmp2
Size: 32KB - Virtual size: 31KB

.reloc
Size: 4KB - Virtual size: 92B