jaffacakes118_HEUR[.]Trojan[.]Win32[.]Generic[.]0fc8374832fa6b74a27a3f47d9058aa5

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.0fc8374832fa6b74a27a3f47d9058aa5
Size 797KB
Sample261013-2rt5kass2j
SHA256 2341a41077a26e2606c6da58353e695d300f94b47e1c5550f8718269880ef16d
MD5 0fc8374832fa6b74a27a3f47d9058aa5
SHA1 41978311387b7dadd1e8c5504fbabf3cf021b94a
SHA512 2f7d58d6cfdcd82e1a76706ae78db281cdd0e9baf08d7444cc31a23f0669a4174fea2e62bb113a56a388abbfcf746bf25798635b177e8cd489947e1367e47655
SSDEEP 24576:ouGr+EK8Ob7JGMyf/MSrOWjh8jrvV8Rf:oLZORGMvW2XS
TLSH
T1D0052382079BBAEAD45A5B78B5D2D71EDFBCAFC038A84C57251D080770059A30D6F3E6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_HEUR.Trojan.Win32.Generic.0fc8374832fa6b74a27a3f47d9058aa5

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.0fc8374832fa6b74a27a3f47d9058aa5

.sys 797KB

jaffacakes118_HEUR.Trojan.Win32.Generic.0fc8374832fa6b74a27a3f47d9058aa5

IMPHASH 161adb35d50fb4ca00aad6770c6a2d5a
SHA256 2341a41077a26e2606c6da58353e695d300f94b47e1c5550f8718269880ef16d
MD5 0fc8374832fa6b74a27a3f47d9058aa5
SHA1 41978311387b7dadd1e8c5504fbabf3cf021b94a
SHA512 2f7d58d6cfdcd82e1a76706ae78db281cdd0e9baf08d7444cc31a23f0669a4174fea2e62bb113a56a388abbfcf746bf25798635b177e8cd489947e1367e47655
SSDEEP 24576:ouGr+EK8Ob7JGMyf/MSrOWjh8jrvV8Rf:oLZORGMvW2XS
TLSH
T1D0052382079BBAEAD45A5B78B5D2D71EDFBCAFC038A84C57251D080770059A30D6F3E6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

761316

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

404B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

INIT

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

Virtual Size

675KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp2

Size

795KB

Virtual Size

795KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

328B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

jaffacakes118_HEUR.Trojan.Win32.Generic.0fc8374832fa6b74a27a3f47d9058aa5

ntoskrnl.exe

hal

generic