jaffacakes118__2735cef4bc0ba97cad3c648e0eb7fa04

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118__2735cef4bc0ba97cad3c648e0eb7fa04
Size 636KB
Sample260920-2e5ersde63
SHA256 957078c0153042ad7bf15a7d7bab4ad2b5d160313c570e015ee0bfdd555cc848
MD5 2735cef4bc0ba97cad3c648e0eb7fa04
SHA1 b945bd24a2b3d6110e6879f574f14dc072525724
SHA512 c97983f4bd1823fbae4db4679ba99a81a7f6d371504e51db46a03b0fafdc0e32bd38ac4e0b52806b50cff1389578942a926cbdf5b085c16ef6c3c647cbd53507
SSDEEP 12288:h1Ug2AbYwIlvYix13JAO3H0WmZMvY7j6z7CQefQrkcuJW:h1x2AbSlvHJJX0MvMj67CpfQk5JW
TLSH
T1F1D42306AA5B1627C4921D31434FDA09BE98DD74111EEF87179F367E7A330AC7C6A832
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118__2735cef4bc0ba97cad3c648e0eb7fa04

File Explorer

jaffacakes118__2735cef4bc0ba97cad3c648e0eb7fa04

.dll 636KB

jaffacakes118__2735cef4bc0ba97cad3c648e0eb7fa04

IMPHASH b08bd71247633e4f2e71c7a78895e9a7
SHA256 957078c0153042ad7bf15a7d7bab4ad2b5d160313c570e015ee0bfdd555cc848
MD5 2735cef4bc0ba97cad3c648e0eb7fa04
SHA1 b945bd24a2b3d6110e6879f574f14dc072525724
SHA512 c97983f4bd1823fbae4db4679ba99a81a7f6d371504e51db46a03b0fafdc0e32bd38ac4e0b52806b50cff1389578942a926cbdf5b085c16ef6c3c647cbd53507
SSDEEP 12288:h1Ug2AbYwIlvYix13JAO3H0WmZMvY7j6z7CQefQrkcuJW:h1x2AbSlvHJJX0MvMj67CpfQk5JW
TLSH
T1F1D42306AA5B1627C4921D31434FDA09BE98DD74111EEF87179F367E7A330AC7C6A832
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1708757

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Name

.text

Size

Virtual Size

449KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

133KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

8KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vmp0

Size

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp1

Size

Virtual Size

308KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_WRITE

Name

.vmp2

Size

620KB

Virtual Size

617KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

120B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

jaffacakes118__2735cef4bc0ba97cad3c648e0eb7fa04

kernel32

user32

gdi32

winmm

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

ws2_32

comdlg32

generic