Behavioral task
behavioral1
Sample
fcd2678cb817765402ba84528da14553_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fcd2678cb817765402ba84528da14553_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
fcd2678cb817765402ba84528da14553_JaffaCakes118
-
Size
5.3MB
-
MD5
fcd2678cb817765402ba84528da14553
-
SHA1
d271b001ae10edbcd3e0891cf1768da000b7f2ae
-
SHA256
8a5ba663b09d70ec3138cba46b19fc2fd5666966168aa7a2714300bef76dd80c
-
SHA512
582ed2332d90a15c786f55aa6cca21e648ff7247e95f7c14b917db958870ee844e3ffd8296aa74a7a9beba0b9a30787bdb6fe392e667d01686931858366e7af8
-
SSDEEP
98304:2YcGMxRe/cRnPvOb+B9aTu3o//wTWBKQlJfED2+haj//f6K2yKbagRnX5jvmzuP3:2IMjKqnHObInQKQlJfEi+s/nH2lXkc
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fcd2678cb817765402ba84528da14553_JaffaCakes118
Files
-
fcd2678cb817765402ba84528da14553_JaffaCakes118.exe windows:6 windows x64 arch:x64
c715613f55b9557b5454a7517b0c668c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
SuspendThread
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
EnumDisplayDevicesA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
RegQueryValueExA
libcrypto-1_1-x64
X509_get_ext_d2i
libssl-1_1-x64
SSL_get_verify_result
ws2_32
freeaddrinfo
msvcp140
??0_Locinfo@std@@QEAA@PEBD@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception
api-ms-win-crt-runtime-l1-1-0
_beginthreadex
api-ms-win-crt-stdio-l1-1-0
_get_stream_buffer_pointers
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-string-l1-1-0
tolower
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-multibyte-l1-1-0
_mbsicmp
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 137KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.3MB - Virtual size: 5.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 196B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ