Behavioral task
behavioral1
Sample
3add582b1771c258d9c5bd41b42f33b9_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
3add582b1771c258d9c5bd41b42f33b9_JaffaCakes118
-
Size
1.2MB
-
MD5
3add582b1771c258d9c5bd41b42f33b9
-
SHA1
8e1a060ea337988b4acaf5d687eef162f96045fd
-
SHA256
afbe1759a53d2da348f931ef38dd7262c5cec0ebf43b18bc40917289d6389c85
-
SHA512
ffd9845ccede18c5635276473f4ac67ec24501a7122e78d2724fb3f59c6c0ae6bec1968ff687fec395b8511feb99eb15c297348c68a5b1eb431abc0a08e6d2f6
-
SSDEEP
24576:fwbmEnTIpQ72nGNrbj+xvD6IwZ0SI1uw4EqNLB:fwbTmQynGNrbj+1wZfIw
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3add582b1771c258d9c5bd41b42f33b9_JaffaCakes118
Files
-
3add582b1771c258d9c5bd41b42f33b9_JaffaCakes118.exe windows:4 windows x86 arch:x86
e99071c3400d339b5320eb224ae8d5ee
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiOutReset
ws2_32
recv
kernel32
GetFileAttributesA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
MapDialogRect
gdi32
GetClipBox
winspool.drv
DocumentPropertiesA
advapi32
RegSetValueExA
shell32
ShellExecuteA
ole32
CoRevokeClassObject
oleaut32
OleCreateFontIndirect
comctl32
ImageList_Destroy
oledlg
ord8
comdlg32
GetSaveFileNameA
Sections
.text Size: - Virtual size: 491KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 259KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 104KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 377KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE