Behavioral task
behavioral1
Sample
128cb9004400f2821f0726cb8359ffa7_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
128cb9004400f2821f0726cb8359ffa7_JaffaCakes118
-
Size
148KB
-
MD5
128cb9004400f2821f0726cb8359ffa7
-
SHA1
fdd2e6dad8038c35d29f066583a31e735f221259
-
SHA256
77ae29c1db5ba948a619aef3b5400cf532d7210903e3d69bad2bc298057972f9
-
SHA512
717055d7f411ec02e5dc59cded863cd66095c8ae5cc14e9657674db8d961b6c0b3db40c6eef2f8c316894ce8ce3cff839ce6dc456f4e0146be3dc62dc78ca1c0
-
SSDEEP
3072:j1a/+JyzuJEXna+uR07YV8lXLqwzNpFpj6i/4O0I4LzU4IMk:s/+Ja4E28YH6pFpuF/ZvP
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 128cb9004400f2821f0726cb8359ffa7_JaffaCakes118
Files
-
128cb9004400f2821f0726cb8359ffa7_JaffaCakes118.exe windows:4 windows x86 arch:x86
3e818ea398f921b36df0244e48179016
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
PeekMessageA
MessageBoxA
advapi32
CryptAcquireContextA
shell32
SHGetPathFromIDListA
atl
ord42
Sections
.text Size: - Virtual size: 66KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 146KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 132KB - Virtual size: 129KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ