29256cf2da414e22764004e6cb6c731d_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

29256cf2da414e22764004e6cb6c731d_JaffaCakes118
Size

236KB
MD5

29256cf2da414e22764004e6cb6c731d
SHA1

dc2a09e0fc71f736870515058f38b82f8265369c
SHA256

b5ad441043fa34e0693ae66439a9aa3585c6384eda7f90d74ce5d6a83ec1a045
SHA512

32a49e49c6a2e4a84703035d56ef5c2576a14832bb9beb568bcb7a3214fa54292684e5ab2a00715fd949f8901acc88f5df9b072506b1ea062dd9130460f1138b
SSDEEP

6144:adjhIRMqYGfBotCgJksZqc6sh4RZEZASH+Ub8f:gSoGZKu26s2vEZZH+D

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
29256cf2da414e22764004e6cb6c731d_JaffaCakes118

Files

29256cf2da414e22764004e6cb6c731d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: - Virtual size: 165KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 225KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 158KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 420KB - Virtual size: 418KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 224B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ