Behavioral task
behavioral1
Sample
141dae1c766fdc2ff58a846c1f135a3b_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
141dae1c766fdc2ff58a846c1f135a3b_JaffaCakes118
-
Size
1.4MB
-
MD5
141dae1c766fdc2ff58a846c1f135a3b
-
SHA1
accd13474edc73c3b8aae1a07d73b381413664d2
-
SHA256
157a6936871f4b4125b9c36f2a8a77ef9cb5cc5ce701b256873226362eb854e4
-
SHA512
1f707fb0ee6fcd89af9312be6ae9685801e3111c6fcf021d4548d7818a29e39e345972a4a5d6b4fd9fa4b68d85dc74f11e21271e13ed8a4092b79efd20bf4455
-
SSDEEP
24576:8fxrxKBTukA6c/FahpIv2Wm9Pmrxc8+OC87jdNzRByrUVmfsIk3zpl1:La6c/FgDWm9+W8jnNzWAgkIkV
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 141dae1c766fdc2ff58a846c1f135a3b_JaffaCakes118
Files
-
141dae1c766fdc2ff58a846c1f135a3b_JaffaCakes118.exe windows:4 windows x86 arch:x86
fd84ccbaa69478ec5fe4f56461027a07
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcmpA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
SetWindowLongA
MessageBoxA
advapi32
RegQueryInfoKeyA
ole32
CoTaskMemRealloc
oleaut32
SysAllocString
gdi32
GetStockObject
ntdll
_stricmp
Sections
.text Size: - Virtual size: 72KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 146KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 168KB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 65KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 220B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ