jaffacakes118_b581d86d0f64355469f487cf5a000e0cd9b4d6caa11f75341e42d6be9492fbdf[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_b581d86d0f64355469f487cf5a000e0cd9b4d6caa11f75341e42d6be9492fbdf.bin
Size 880KB
Sample260924-2llagateka
SHA256 b581d86d0f64355469f487cf5a000e0cd9b4d6caa11f75341e42d6be9492fbdf
MD5 8ba64a91769ae862c9959dda68c7006d
SHA1 3e90f9c212507efdb53cd9225ee4f2e812a0619d
SHA512 d9866cd53e4b6226ef4cf260663fb9354fd72c829f270f236179e59a536882f6add77698447d08204372fedc216997df98033f75da4bed6d70e26bf2497ae98c
SSDEEP 12288:edEV/yf0JHts5Rk2bWjgXmWr2dFEOTBnRRcmXFpR709gham4bBr:e0/ycJHaRQjgUdRTxnxXjR7090azJ
TLSH
T1E915AD117681C472C0663534C4A6D6F976AABC20EA358A4F7B933F6F7F305D25A2834B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_b581d86d0f64355469f487cf5a000e0cd9b4d6caa11f75341e42d6be9492fbdf.bin

File Explorer

jaffacakes118_b581d86d0f64355469f487cf5a000e0cd9b4d6caa11f75341e42d6be9492fbdf.bin

.exe 880KB

jaffacakes118_b581d86d0f64355469f487cf5a000e0cd9b4d6caa11f75341e42d6be9492fbdf.bin

IMPHASH 282d389d12279b0cbc9f907c072d06fc
SHA256 b581d86d0f64355469f487cf5a000e0cd9b4d6caa11f75341e42d6be9492fbdf
MD5 8ba64a91769ae862c9959dda68c7006d
SHA1 3e90f9c212507efdb53cd9225ee4f2e812a0619d
SHA512 d9866cd53e4b6226ef4cf260663fb9354fd72c829f270f236179e59a536882f6add77698447d08204372fedc216997df98033f75da4bed6d70e26bf2497ae98c
SSDEEP 12288:edEV/yf0JHts5Rk2bWjgXmWr2dFEOTBnRRcmXFpR709gham4bBr:e0/ycJHaRQjgUdRTxnxXjR7090azJ
TLSH
T1E915AD117681C472C0663534C4A6D6F976AABC20EA358A4F7B933F6F7F305D25A2834B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

81836

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Work\train\Tetris\Release\Tetris.pdb

kernel32

WritePrivateProfileStringA GlobalFlags GetCPInfo GetOEMCP GetCommandLineA GetStartupInfoA HeapAlloc HeapFree RtlUnwind HeapReAlloc RaiseException VirtualAlloc Sleep SetStdHandle GetFileType HeapSize TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetACP IsValidCodePage LCMapStringA TlsFree GetStdHandle FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount GetConsoleCP GetConsoleMode GetTimeZoneInformation GetStringTypeA GetStringTypeW WriteConsoleA GetConsoleOutputCP WriteConsoleW CompareStringW SetEnvironmentVariableA DeleteCriticalSection LocalReAlloc TlsSetValue TlsAlloc InitializeCriticalSection GlobalHandle GlobalReAlloc EnterCriticalSection TlsGetValue LeaveCriticalSection LocalAlloc InterlockedIncrement GetModuleHandleW GetFileTime GetFileSizeEx GetFileAttributesA FileTimeToLocalFileTime FileTimeToSystemTime SetErrorMode GlobalGetAtomNameA GlobalFindAtomA lstrcmpW GetVersionExA InterlockedDecrement GetModuleFileNameW GetCurrentProcessId GlobalAddAtomA FreeResource GlobalDeleteAtom GetCurrentThread GetCurrentThreadId ConvertDefaultLocale EnumResourceLanguagesA GetLocaleInfoA CompareStringA InterlockedExchange lstrcmpA GlobalFree GlobalAlloc GlobalLock GlobalUnlock FormatMessageA LocalFree MulDiv CreateFileA GetFullPathNameA GetVolumeInformationA FindFirstFileA FindClose DuplicateHandle GetFileSize SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer WriteFile ReadFile WideCharToMultiByte SetLastError GetLastError FindResourceA LoadResource LockResource SizeofResource WaitForSingleObject CreateRemoteThread WriteProcessMemory VirtualAllocEx OpenProcess CloseHandle Process32Next Process32First CreateToolhelp32Snapshot DeleteFileA GetWindowsDirectoryA MultiByteToWideChar GetSystemDirectoryA GetModuleHandleA ExitProcess GetModuleFileNameA GetCurrentProcess GetProcAddress LoadLibraryA lstrlenA CopyFileA LoadLibraryExA LCMapStringW FreeLibrary

user32

DestroyMenu UnregisterClassA LoadCursorA GetSysColorBrush ShowWindow SetWindowTextA IsDialogMessageA RegisterWindowMessageA SendDlgItemMessageA WinHelpA GetCapture GetClassLongA GetClassNameA SetPropA GetPropA RemovePropA SetFocus GetWindowTextA GetForegroundWindow GetTopWindow GetMessageTime GetMessagePos MapWindowPoints SetForegroundWindow UpdateWindow CreateWindowExA GetClassInfoExA GetClassInfoA RegisterClassA AdjustWindowRectEx CopyRect PtInRect GetDlgCtrlID DefWindowProcA CallWindowProcA GetMenu SetWindowLongA SetWindowPos SystemParametersInfoA GetWindowPlacement GetWindowRect GetWindow GetSysColor EndPaint BeginPaint ReleaseDC GetDC ClientToScreen GrayStringA DrawTextExA LoadIconA SendMessageA IsIconic GetSystemMetrics DrawTextA TabbedTextOutA UnhookWindowsHookEx GetWindowThreadProcessId GetLastActivePopup MessageBoxA SetCursor SetWindowsHookExA CallNextHookEx GetMessageA TranslateMessage DispatchMessageA IsWindowVisible GetKeyState SetMenu GetClientRect DrawIcon EnableWindow CharUpperA GetSubMenu GetMenuItemCount GetMenuItemID GetMenuState PostMessageA PostQuitMessage EndDialog GetNextDlgTabItem GetParent IsWindowEnabled GetDlgItem GetWindowLongA PeekMessageA GetCursorPos ValidateRect SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapA GetFocus ModifyMenuA EnableMenuItem CheckMenuItem GetDesktopWindow GetActiveWindow SetActiveWindow CreateDialogIndirectParamA DestroyWindow IsWindow

gdi32

DeleteDC GetStockObject TextOutA ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape GetDeviceCaps RectVisible PtVisible GetObjectA DeleteObject GetClipBox SetMapMode SetTextColor SetBkColor RestoreDC SaveDC CreateBitmap ExtTextOutA

comdlg32

GetFileTitleA

winspool.drv

DocumentPropertiesA OpenPrinterA ClosePrinter

advapi32

RegSetValueExA RegCreateKeyExA RegQueryValueA RegEnumKeyA RegDeleteKeyA RegOpenKeyExA RegOpenKeyA RegCloseKey RegQueryValueExA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken

shlwapi

PathFindExtensionA PathFindFileNameA PathStripToRootA PathIsUNCA

oleaut32

VariantClear VariantChangeType VariantInit

Name

.text

Size

157KB

Virtual Size

156KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

34KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

459KB

Virtual Size

474KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

124KB

Virtual Size

124KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vmp0

Size

29KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

64KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_b581d86d0f64355469f487cf5a000e0cd9b4d6caa11f75341e42d6be9492fbdf.bin

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shlwapi

oleaut32

generic