45ac2cfc001c35a0f5d3770ef856ad21_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

45ac2cfc001c35a0f5d3770ef856ad21_JaffaCakes118
Size

436KB
MD5

45ac2cfc001c35a0f5d3770ef856ad21
SHA1

1f08d95ca41cfcac070c703442923a61f06f585f
SHA256

76c1a54e6ce81f4b30824f839b1f1a56e01573c84244ba76a076187dc3497808
SHA512

12d82b668ce34ae3626ec9c5ecd76b47647a97bc79ffcb3269dd28789d41b82c3133121d8294439804d78da2dbd6580dcc6d49b25e394e67189f565cce5832c4
SSDEEP

12288:XL2ywVW9DoH+bojLdye35PE4ulT5mPF0:XalWNoH+EtyaZErlNu0

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
45ac2cfc001c35a0f5d3770ef856ad21_JaffaCakes118

Files

45ac2cfc001c35a0f5d3770ef856ad21_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a7165730fe542215bef53047cac06f30

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

netapi32

Netbios

ws2_32

socket

kernel32

MultiByteToWideChar
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

shell32

ShellExecuteA

Sections

.text
Size: - Virtual size: 114KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 276KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 100KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 432KB - Virtual size: 428KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE