2e736e2155693517deee16fc5b90beae_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2e736e2155693517deee16fc5b90beae_JaffaCakes118
Size

296KB
MD5

2e736e2155693517deee16fc5b90beae
SHA1

0ea86484759bc33519332bf14b9edd7e22e0e93c
SHA256

abb1926736d6851e9f6d1d6185819153318b057481d7d6e7b0e825345aa753d1
SHA512

4160f25f0a425bfec4ba4915eff095bc444ba551f02e1fbb3773d6e57aa35c80a30bfa93fc24c81ade0ef2bc6a49a57cb75fc9d4eb2b725b41e1927fb771e89b
SSDEEP

6144:Y0aw9DN46t0AB8BL9ZJQ0IkfsOZiXi0NMA9ti7z+ifr3QMOI:Y0a+W6t0um5M0KOp0+suhfBOI

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2e736e2155693517deee16fc5b90beae_JaffaCakes118

Files

2e736e2155693517deee16fc5b90beae_JaffaCakes118
.dll windows:4 windows x86 arch:x86

9151be732b70b9840195897b1491b923

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

realloc
rand
_ftol
malloc
strncmp
atoi
strtod
floor
_CIpow
_CIfmod
modf
strncpy
_initterm
_adjust_fdiv
sprintf
free
srand

user32

GetGUIThreadInfo
GetWindowThreadProcessId
PostMessageA
GetForegroundWindow
MsgWaitForMultipleObjects
keybd_event
GetDC
ReleaseDC
mouse_event
FindWindowA
GetAsyncKeyState
EnumDisplaySettingsA
ClientToScreen
GetClientRect
GetParent
IsWindow
GetWindowRect
MoveWindow
ShowWindow
IsIconic
IsWindowVisible
PrintWindow
MessageBoxA
wsprintfA
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA
GetSystemMetrics
CallWindowProcA

kernel32

MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
LocalSize
WideCharToMultiByte
GetVersionExA
LCMapStringA
GetTickCount
GetModuleFileNameA
HeapReAlloc
ExitProcess
HeapFree
VirtualFree
VirtualAlloc
HeapAlloc
GetProcessHeap
WaitForSingleObject
CreateRemoteThread
WriteProcessMemory
ReadProcessMemory
VirtualFreeEx
VirtualAllocEx
VirtualProtectEx
SetWaitableTimer
CreateWaitableTimerA
CreateProcessA
OpenProcess
TerminateProcess
CreateFileMappingA
CloseHandle
UnmapViewOfFile
CreateThread
Sleep
GetCurrentProcess
GetModuleHandleA
GetProcAddress
GetCurrentThread
Beep
LoadLibraryA
VirtualQueryEx
VirtualProtect
RtlUnwind
RtlMoveMemory
IsBadWritePtr
RtlZeroMemory
lstrcpyn
IsBadReadPtr
OpenFileMappingA
MapViewOfFile
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess

winmm

PlaySoundA
timeSetEvent

advapi32

LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken

gdi32

CreateFontIndirectA
SelectObject
CreateCompatibleBitmap
GetPixel
DeleteDC
GetDIBits
GetObjectA
BitBlt
CreateDIBSection
CreateCompatibleDC
DeleteObject
TextOutA
SetTextColor
SetBkMode

Exports

Exports

EventTimer

Sections

.text
Size: - Virtual size: 61KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 213KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: - Virtual size: 69KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp2
Size: 288KB - Virtual size: 284KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 188B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9151be732b70b9840195897b1491b923

Headers

File Characteristics

Imports

msvcrt

user32

kernel32

winmm

advapi32

gdi32

Exports

Exports

Sections

.text Size: - Virtual size: 61KB

.rdata Size: - Virtual size: 3KB

.data Size: - Virtual size: 213KB

.vmp0 Size: - Virtual size: 2KB

.vmp1 Size: - Virtual size: 69KB

.vmp2 Size: 288KB - Virtual size: 284KB

.reloc Size: 4KB - Virtual size: 188B

.text
Size: - Virtual size: 61KB

.rdata
Size: - Virtual size: 3KB

.data
Size: - Virtual size: 213KB

.vmp0
Size: - Virtual size: 2KB

.vmp1
Size: - Virtual size: 69KB

.vmp2
Size: 288KB - Virtual size: 284KB

.reloc
Size: 4KB - Virtual size: 188B