Behavioral task
behavioral1
Sample
099ec95c1464d69c1f33eab214a2a4f4_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
099ec95c1464d69c1f33eab214a2a4f4_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
099ec95c1464d69c1f33eab214a2a4f4_JaffaCakes118
-
Size
55KB
-
MD5
099ec95c1464d69c1f33eab214a2a4f4
-
SHA1
35d6d153f5da9bfaf0f21ca9abcbaf0a0fb754c6
-
SHA256
abe1793b3f5b2f680dd7e9a32525f8cf3d8e831bb6a580b3d02f208666982d9a
-
SHA512
be47a7b3e0edafb6c44408dbd613c5d4d549b7ae44ea26fc387cf167549e260bb8821b29339534af280893867432d67dbf214a8c4cb369ac1c3260358897a0a5
-
SSDEEP
1536:ALvdl9V8HjSh4J3PrF5ShUsoJYcMzHRGOxDZ/rHWNC2:ALv7PYjSeprF5+UfJYzxGOXr2k
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 099ec95c1464d69c1f33eab214a2a4f4_JaffaCakes118
Files
-
099ec95c1464d69c1f33eab214a2a4f4_JaffaCakes118.exe windows:4 windows x86 arch:x86
6cba0077f5c24d19a45d246f669dd99a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
htonl
sendto
inet_addr
gethostbyname
WSASocketA
WSAIoctl
socket
htons
connect
send
select
__WSAFDIsSet
recv
shutdown
setsockopt
closesocket
WSAStartup
kernel32
GetProcAddress
LoadLibraryA
GetSystemDirectoryA
GetStartupInfoA
Sleep
GetTickCount
ResumeThread
CreateProcessW
SetThreadPriority
GetCurrentThread
SetPriorityClass
GetCurrentProcess
lstrcatW
GetEnvironmentVariableW
GetShortPathNameW
GetModuleFileNameW
FreeLibrary
CreateProcessA
TerminateProcess
OpenProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
DuplicateHandle
CreateFileA
GetLastError
GetModuleHandleA
ReadFile
GetFileSize
SetFileAttributesA
ExitProcess
CopyFileA
lstrcmpiA
lstrcatA
GetModuleFileNameA
SetErrorMode
lstrlenA
WaitForSingleObject
CreateThread
CreateMutexA
DeleteFileA
InterlockedExchange
lstrcpyA
GlobalMemoryStatusEx
GetVersionExA
CloseHandle
OutputDebugStringA
VirtualAlloc
VirtualQueryEx
ReadProcessMemory
GetThreadContext
SetThreadContext
WriteProcessMemory
VirtualProtectEx
VirtualFree
GetCurrentProcessId
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
wsprintfA
wsprintfW
ExitWindowsEx
wvsprintfA
MessageBoxA
advapi32
RegOpenKeyExA
RegQueryValueExA
DeleteService
CreateServiceA
RegOpenKeyA
RegSetValueExA
RegCloseKey
RegisterServiceCtrlHandlerA
SetServiceStatus
StartServiceCtrlDispatcherA
OpenSCManagerA
OpenServiceA
StartServiceA
CloseServiceHandle
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
msvcrt
_ui64toa
strstr
strcspn
atoi
_strnicmp
memmove
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_strlwr
sprintf
rand
srand
strncpy
??2@YAPAXI@Z
??3@YAXPAX@Z
__CxxFrameHandler
_except_handler3
shell32
ShellExecuteA
Sections
.text Size: - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 52KB - Virtual size: 51KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 152B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ