Behavioral task
behavioral1
Sample
376f5b25292a5e572e8158fb38e1179a_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
376f5b25292a5e572e8158fb38e1179a_JaffaCakes118
-
Size
812KB
-
MD5
376f5b25292a5e572e8158fb38e1179a
-
SHA1
e0315d197437836492251e9f8a11941eaf2b048e
-
SHA256
78432cdc3a96b5044a688be06b7e5907a537b96a12edbba5f90c37e1a98f781b
-
SHA512
b1b9692d882fbc6c7bc8f92ba6c93e3e783d847ed09a59d5899b66bd19212867d77f22408d214d2a6f4cc1d442cae5ddc89cdc59649d6af05831d4dbb245be7f
-
SSDEEP
24576:f3QHbn4pSHYQ7YD9luswLhf5FZzrTcpNllvQKR:2+S17YZYtF943vQM
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 376f5b25292a5e572e8158fb38e1179a_JaffaCakes118
Files
-
376f5b25292a5e572e8158fb38e1179a_JaffaCakes118.exe windows:4 windows x86 arch:x86
d18ea08ba845c7cdd8cecbef7fed6269
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasHangUpA
kernel32
TlsSetValue
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
PostMessageA
MessageBoxA
gdi32
LPtoDP
winmm
waveOutOpen
winspool.drv
DocumentPropertiesA
advapi32
RegQueryValueA
shell32
ShellExecuteA
ole32
OleUninitialize
oleaut32
LoadTypeLi
comctl32
ord17
ws2_32
setsockopt
wininet
InternetCloseHandle
comdlg32
GetSaveFileNameA
Sections
.text Size: - Virtual size: 437KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 107KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 171KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 421KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 788KB - Virtual size: 784KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE